Controlled Substances

Controlled Substances - Banner Image

This website has been prepared by the University of Maryland, Baltimore (UMB) Environmental Health and Safety (EHS) office to assist UMB investigators who use drugs or substances controlled by the Drug Enforcement Administration (DEA), defined as “controlled substances,” for research use. All Registrants and Authorized Users of controlled substances must be appropriately registered with the Maryland Office of Controlled Substances Administration (OCSA) and federally with the DEA.

In addition to complying with all applicable state and federal laws, UMB CDS investigators must adhere to UMB’s Policy on Research Use of Controlled Substances VI-99.00(A).

Who To Contact

For more information and/or guidance on registration, storage, recordkeeping, disposal, or other CDS-related topics, contact

Shannon Sussman
Chemical Hygiene Officer

Stephanie Brandal
EHS Specialist

UMB Definitions

Registrant: A person employed by UMB who has obtained UMB Registration from the Office of Environmental Health and Safety (EHS), as well as Federal/State Registration, to acquire, store, manufacture, use and dispose of Controlled Substances.

Authorized Person/Authorized User: A UMB faculty member, staff, or student working under the direction or authorization of a Registrant to have access to or use for research Controlled Substances held in a Registered Location under the responsibility of that Registrant. Volunteers and visitors may not be Authorized Persons. No one under the age of 21 may be an Authorized Person. Human Resources Services (HRS) will review authorized user designation. All authorized persons must be reported to EHS through the UMB EHS Controlled Substances Information form. This does not constitute approval or registration of personnel with the Federal DEA or State OCSA offices; changes to authorized personnel must be reported directly to the DEA or OCSA by the registrant. Inclusion on other institutional protocols (such as Institutional Animal Care and Use Committee IACUC protocols) does not constitute authorization to share controlled substances.

Controlled Substance/Controlled Dangerous Substances (CDS): Any substance listed in the Controlled Substances Act, Code of Federal Regulations (alphabetic list).

Controlled Substance Schedules 

There are five established Schedules of controlled substances (21 CFR 1308.11-15; I, II, III, IV, and V, from most stringently controlled to less), where determination is based on potential for abuse, whether there is an accepted medical use for treatment in the United States, and their potential to cause dependence. A list of controlled substances by schedule number is available.

Schedule I drugs have a high potential for abuse, there is no currently accepted medical use in the U.S., and lack of accepted safety for use under medical supervision. Examples include tetrahydrocannabinols and heroin.

Schedule II drugs have a high potential for abuse, there is a currently accepted medical use in the U.S., perhaps with severe restrictions, and abuse may lead to severe psychological or physical dependence. Examples include fentanyl, morphine, pentobarbital, and cocaine.

Schedule III drugs have less potential for abuse than those listed in Schedules I and II, there is a currently accepted medical use in the U.S., and abuse may lead to moderate or low physical dependence or high psychological dependence. Examples include buprenorphine and ketamine.

Schedule IV drugs have low potential for abuse relative to drugs in Schedule III, there is a currently accepted medical use in the U.S., and abuse may lead to limited dependence relative to drugs on Schedule III. Examples include diazepam and midazolam.

Schedule V drugs have low potential for abuse relative drugs in Schedule IV, there is a currently accepted medical use in the U.S., and abuse may lead to limited dependence relative to drugs in Schedule IV.


This guidance applies to the acquisition, use, manufacture, storage, disposal, and lawful disposition of controlled substances used for research purposes. This policy applies to all registrants and those authorized persons working with controlled substances under registrant supervision.

This guidance does not apply to licensed practitioners dispensing controlled substances in the course of their professional practices, as authorized by their licenses as health care practitioners or dispensing controlled substances in the course of human subjects research within any hospital in the University of Maryland Medical Center, at the Baltimore Veterans Affairs Medical Center, or at any other health care facility that takes responsibility for the inventory and control of controlled substances being used in research.

Controlled Substance Information Form

To begin the data collection process, Environmental Health and Safety (EHS) is asking all UMB investigators with a state and federal registration to contact Shannon Sussman


All registrants and authorized users must complete the EHS Controlled Substance training module. Please contact Shannon Sussman for access. 

Registration (21 CFR 1301)

All purchase and use of CDS for research must be conducted under appropriate registration. In the state of Maryland, this requires registration through the US DOJ DEA Diversion Control Division as well as through the Maryland Department of Health Office of Controlled Substances Administration (OCSA).

Registrants may not conduct research using controlled substances using a medical/practitioner registration (COMAR Registration, Registration Certificate and DEA Practitioner’s Manual, Section II- General Requirements). A medical registration is intended for prescription, administration, or direct dispensation at the listed place of business and does not allow for authorization of subordinate personnel to handle materials obtained under the license at the registrant’s research laboratory.

In June of 2022, the DEA released a Researcher's Manual: An Informational Outline of the Controlled Substances Act, which offers some clarification of situations that may not occur in clinical practice.

If Schedule I substances are to be used, a separate registration specifically for Schedule I substances must be obtained. 

In addition to federal and state registration, registrants must also complete the UMB EHS Controlled Substances Information Form, detailing:

  • UMB directory email of the registrant
  • OCSA permit # and DEA license #
  • UMB directory email of each authorized user
  • UMB building and room location registered for secure storage and use of CDS
  • Name and Schedule of each CDS held or permitted to be held by the registrant

EHS Advice for New Registrants 

You will need approval by both the state of Maryland through the Office of Controlled Substances Administration (OCSA) as well as federally through the Diversion Control Division of the Drug Enforcement Agency (DEA).

If you will work only with Schedule II-V substances, you must first register with the OCSA, wait for approval, then register with the DEA using your OCSA number.

If you work with any Schedule I substances, you should first register with the DEA, wait for approval, then register with the OCSA.  

OCSA website:

  • You will also need to complete the Researcher Questionnaire:
  • For the fee exempt portion of the state application, please contact Alexandra (Alex) Zouras-Wieneke; (410) 706-4439
  • Section 4: Mandatory PDMP requirement does not apply to research use, this is for prescribers (but if you’ve already done this as a clinician, you can answer Yes)
  • Section 5: “Attestation: A. Have you completed the Mandatory 2-Hour Continuing Education (CE) Course relating to Prescribing or Dispensing of Controlled Substances prior to obtaining a Controlled Substances registration” does not apply to researchers, per the 5th question in the below FAQ, but as above, if you did this anyhow as a clinician then you can answer this.
  • For the question regarding reverse distributors for disposal, please contact EHS.  

**(update 8/11/21) Since the pandemic, the OCSA is only accepting online applications and that has caused some issues. Another researcher forwarded some very helpful guidance on how to get through the online form:

Question: For a research application, I cannot proceed without entering a PDMP code — how should I respond to the PDMP mandate question?

Answer: In box where you would otherwise type your PDMP code, type “Exempt- Research License”

Question: The only two options in the pull-down menu for attesting to the completion of 2-Hour Continuing Education training are “yes” and “no.” Selecting “no”  prompts you to do the training or you cannot continue with the online application.  Since this is not a requirement for a research license, how should I respond?

Answer: This training is not a requirement for researchers, and therefore will be ignored by reviewers. Respond with “yes” and continue the online application.

Question: The applicant has a PhD but not an MD degree. Online application will not allow you to advance without entering an expiration date for your professional license. Is a professional license a prerequisite to obtain a Researcher license?

Answer: Having a professional license is not a requirement for researchers, and therefore this question also will be ignored by reviewers. Enter any string of numbers and any future date to continue with online application.

Question: The online form is asking for a National Provider Identifier Number. What should I enter?

Answer: For researchers, this is not applicable. Please enter 0. 

Question: How long will it take for review process to get my CDS license approved?

Answer: The website says 10 days but due to COVID-related issues, it will take approximately 3-4 weeks.

DEA website:

  • You will need to complete DEA Form 225, which covers Researchers.
  • You may or may not be required to submit a researcher questionnaire that asks the same basic questions as the OCSA (but requires that you submit home addresses and SSNs for your authorized users).
  • You may or may not be contacted for an in-person inspection prior to approval.
  • See the DEA Registration Q&A page for common questions.

Inventory and Recordkeeping Requirements (21 CFR 1304.04)

Each registrant must keep complete and accurate records for all controlled substances, from ordering to disposal. Records should be kept by the registrant for at least two years from the date the record was made, on-site, and be made readily available for inspection. Records should include ordering records, records of receipt, records of use, records of disposal, and complete inventories.

The DEA requires that an initial inventory be taken on the date he or she first engages in activity with CDS. After this date, at a minimum, a biennial inventory (every two years, within two years of the previous inventory) should be taken. Note that an inventory consists of a count of all controlled substances on hand on a given day. The inventory should include a separate listing for each kind of substance or preparation, the number of packages, total content of packages, with individual amounts in containers if not full.

A running log of activities should also be kept to document when, where, and for what purpose the substance was used, but is not the same as an inventory. It is best practice to uniquely identify containers in multi-pack packages, particularly if they contain multiple doses. The running log and inventory should specify the amount remaining in each container by their unique identifier. These records must be kept for both stock and working solutions.

Inventories and records for Schedule I and II drugs must be kept separate from Schedule III-V.

EHS strongly recommends that dedicated, bound notebooks be used for running logs and inventories, as looseleaf or binder documentation can lead to lost records, retroactive recordkeeping, and replaced records. Any written documentation must be written in indelible ink.

Personnel Screening (21 CFR 1301.90)

Registrants must ensure that an accurate and complete list of authorized users is maintained in their records, with EHS, and with the DEA and OCSA. When access is to be given to a new authorized user, registrants must notify EHS, DEA, and OCSA.

Per DEA regulation, it is assumed that the following questions will become a part of an employer's comprehensive employee screening program:

Question. Within the past five years, have you been convicted of a felony, or within the past two years, of any misdemeanor or are you presently formally charged with committing a criminal offense? (Do not include any traffic violations, juvenile offenses or military convictions, except by general court-martial.) If the answer is yes, furnish details of conviction, offense, location, date, and sentence.

Question. In the past three years, have you ever knowingly used any narcotics, amphetamines, or barbiturates, other than those prescribed to you by a physician? If the answer is yes, furnish details.

Diversion, Theft, or Loss of Controlled Substances

Anyone having knowledge or reasonable suspicion of Inventory irregularities or diversion, theft, or loss of CDS has an obligation to report such information to UMB Public Safety, EHS, and the Registrant (if the Registrant is not the person reporting). The Registrant shall notify the DEA Field Division Office of any theft or significant diversion or loss of any Controlled Substances upon discovery of the theft, loss, or diversion.

DEA District Field Office

200 St. Paul Plaza, Suite 2222
Baltimore, MD 21202

Controlled Substance Inspections

Investigators must comply with periodic inspections of federal and state registrations, physical locations, containment infrastructure, security controls, and records. A list of inspection findings is available for review. A full physical inspection will be conducted at least once for every UMB registrant, and an enhanced general inspection performed thereafter along with the general lab audit.

Common Inspection Findings 


  1. Running logs kept on loose-leaf paper, binder, or easily modified notebook.

    EHS strongly recommends the use of dedicated, bound notebooks, as loose-leaf, spiral-bound, perforated, or solely digital records can lead to lost records, retroactive recordkeeping, and replaced records. All written documentation must be written in indelible ink.

    When moving records to a bound notebook, there is no need to re-create records that were once on loose-leaf. Transfer over the last relevant data (if you are mid-bottle, move that information over, but you don’t need to move over bottles that were used previously) and continue in the bound notebook for the future. Keep all old records in case of inspection for at least two years from the date of last entry.

  2. Log is incomplete, incorrect, does not have enough information, or cannot be followed.

    A running log should be readily understandable, so that upon inspection it is clear what was used and what is remaining in the lab stocks.

    EHS does not provide a required template, as different labs may require different recordkeeping practices that fit within the space of a particular notebook.

    Recommended columns include:


    Container ID

    Amount used

    Amount remaining

    Admin’d to (#animals)

    Admin by (initials or signature)

    Name of the substance can be another column, or appear as a page header, along with concentration.

    All bottles must either come to 0 (zero) in the log, be found in the inventory, or be accompanied by a note that indicates disposal. If there is a small amount remaining but it is irretrievable for the purposes of the experiment, make a note rather than leave a listing of 50ul that can no longer be found in inventory. It is strongly recommended that any additions to stock (through purchases) or deletions from stock (for example, disposals) be kept in the log as well, whether it is maintained on a separate page, or appears as a note in the running log by chronological order.

  3. Containers do not have unique identifiers.

    Each container should have a unique identifier, which is also used in the log. If a package contains 5 bottles of 1 ml each, they should be identified, for example, as 12-1, 12-2, 12-3, 12-4, and 12-5. Each 1ml container in this example must be tracked, rather than treating the whole package as 5ml.

  4. No inventory, only a running log.

    A running log notes what is used when; it is used in day-to-day operations. An inventory is a biennial (every two years) list of every controlled substance, in every formulation, whether stock or working, expired, unexpired, or scheduled for disposal, under a registrant’s control on a given date. Registrants are expected to keep both a running log AND a biennial inventory of controlled substances.

  5. Expired controlled substances - must contact EHS/Simone for disposal.

    An Excel disposal sheet must be submitted to EHS, which will review and forward on to the reverse distributor. This is not a quick process, so the sooner a sheet is submitted, the better.

  6. Controlled substances not properly secured and stored.

    CDS must always be stored and secured as approved on DEA and OCSA registrations, double locked in a safe or cabinet of substantial construction. If CDS are being actively used, they must be under the direct control of the registrant or an authorized user.

  7. Empty containers being stored.

    Some labs keep their empty containers just in case they are needed for disposal. If the container is empty, or as empty as can be reasonably expected, through necessary practices, the registrant or authorized user must deface the original label (so the content is no longer identifiable), triple-rinse the container if possible, then throw away the container. Pouring unwanted CDS down the drain or into general hazardous waste containers is not a necessary practice, so this is NOT an accepted means of disposal. This should only be used for containers that are actually empty.

  8. Non-CDS stored with CDS.

    CDS must be kept stored separately from non-CDS. There is an item in the regulations where Schedule III, IV, and, V substances may be stored with non-CDS, but only with prior written permission from a DEA Special Agent in Charge. Without that written permission, the expectation is that non-CDS are kept separately. 

  9. CDS is used or shared inappropriately. IACUC approval is not the same as DEA/OCSA approval to use controlled substances.

    Investigators are not “allowed to use controlled substances” because they have IACUC approval. In a similar vein, investigators may not share controlled substances with other PIs “that are on their IACUC protocol.”

  10. Medical registration is used for research use inappropriately. A research-specific registration is required for research using controlled substances.

    Registrants may not conduct research using controlled substances using a medical/practitioner registration. A medical registration is intended for prescription, administration, or direct dispensation at the listed place of business and does not allow for authorization of subordinate personnel to handle materials obtained under the license at the registrant’s research laboratory. If a clinician prescribes CDS during medical practice and conducts research using CDS, then they must have a research registration with the DEA and with the OCSA as well as a medical registration with the DEA and OCSA.

  11. Thefts or losses must be reported to the DEA, OCSA, UMB Police, and EHS.

    If you are unsure if the theft or loss has been reported or if you have any information of these activities, reach out to EHS at 410-706-7055.