Masters Pharmaceutical, Inc. v. Drug Enforcement Administration

United States Court of Appeals

FOR THE DISTRICT OF COLUMBIA CIRCUIT

Argued January 12, 2017 Decided June 30, 2017

No. 15-1335

MASTERS PHARMACEUTICAL, INC.,

PETITIONER

v.

DRUG ENFORCEMENT ADMINISTRATION,

RESPONDENT

On Petition for Review of a Final Order

of the Drug Enforcement Administration

Richard T. Lauer argued the cause for petitioner. With

him on the briefs were John A. Gilbert Jr., Karla L. Palmer,

and Andrew J. Hull.

Nicolas Riley, Attorney, U.S. Department of Justice,

argued the cause for respondent. With him on the brief were

Benjamin C. Mizer, Principal Deputy Assistant Attorney

General, and Mark B. Stern, Attorney. Anita J. Gay and Lena

D. Watkins, Attorneys, entered appearances.

Gregory G. Garre, Philip J. Perry, Andrew D. Prins,

Alexandra Shechtel, Richard L. Frank, David L. Durkin, and

Donald L. Bell II were on the brief for amici curiae Healthcare

Distribution Management Association and National

Association of Chain Drug Stores in support of neither party.

2

Larry P. Cote was on the brief for amicus curiae Generic

Pharmaceutical Association in support of neither party and in

support of neither affirmance nor reversal.

Before: SRINIVASAN and PILLARD, Circuit Judges, and

EDWARDS, Senior Circuit Judge.

Opinion for the Court filed by Circuit Judge PILLARD.

PILLARD, Circuit Judge: Breakthroughs in the

development of prescription opioid painkillers have vastly

increased their popularity. But that popularity has taken a toll.

Opioids are heavily addictive and often lethal in high doses.

The Drug Enforcement Administration (DEA or agency) has

therefore listed opioids such as hydrocodone and oxycodone as

controlled substances so that DEA can monitor and restrict

their sale. Over the past two decades, DEA has been battling a

steep increase in prescription opioid abuse—a problem that

DEA views as an “epidemic.” U.S. Dep’t of Justice, Drug Enf’t

Admin., Order to Show Cause (Aug. 9, 2013), J.A. 8-9. The

Department of Health and Human Services (HHS), too, sees

the rising abuse of prescription opioids as “a serious and

challenging” public health issue. DEP’T OF HEALTH & HUMAN

SERVS., OPIOID ABUSE IN THE U.S. AND HHS ACTIONS TO

ADDRESS OPIOID-DRUG RELATED OVERDOSES AND DEATHS

(2015). Since 1999, the number of deaths from prescription

painkillers in the United States has more than quadrupled.

CENTERS FOR DISEASE CONTROL AND PREVENTION, Opioid

Overdose: Understanding the Epidemic,

https://www.cdc.gov/drugoverdose/epidemic/index.html (last

visited June 12, 2017). Prescription opioids now kill an

average of 44 Americans per day. U.S. DEP’T OF HEALTH &

HUMAN SERVS., About the Epidemic,

3

https://www.hhs.gov/opioids/about-the-epidemic (last visited

June 12, 2017).

Masters Pharmaceuticals, Inc., (Masters) supplies

prescription medications in bulk to pharmacies across the

United States. Before this litigation began, Masters was

registered with DEA as a vendor of controlled substances,

including opioids. As a registrant, Masters had an obligation

to report to DEA suspicious orders for controlled substances

and to take other precautions to ensure that those medications

would not be diverted into illegal channels.

This case challenges DEA’s 2014 decision to revoke

Masters’ certificate of registration, without which Masters

cannot sell controlled substances. The revocation order turned

on DEA’s conclusion that Masters had shirked its legal

obligation to report suspicious orders for controlled substances.

Masters challenges the factual basis of DEA’s revocation

decision, and claims it exceeded DEA’s authority under its

existing regulations, effectively broadening them in a manner

that was inconsistent with the Administrative Procedure Act

(APA). In addition, Masters suggests, DEA improperly relied

on arguments and evidence that were not presented during the

administrative trial, in violation of the Due Process Clause.

Because we see no prejudicial error in DEA’s decision, we

deny Masters’ petition for review.

I.

A.

The Controlled Substances Act authorizes commercial

distribution of certain controlled substances for therapeutic use,

but requires all distributors to register with DEA. See 21

U.S.C. § 823(b), (e); 28 C.F.R. § 0.100. The Administrator of

DEA (the Administrator) closely observes registered

4

distributors to ensure that their operations are “[]consistent

with the public interest.” 21 U.S.C. § 824(a)(4); see also 28

C.F.R. § 0.100; 21 C.F.R. § 1301.71. In evaluating a

distributor’s operations, the Administrator considers: (1)

whether the distributor has maintained “effective control[s]

against diversion of particular controlled substances into other

than legitimate medical, scientific, and industrial channels”; (2)

whether the distributor has complied with applicable state and

local laws; (3) whether the distributor has previously been

convicted under federal or state laws for a crime related to the

sale of controlled substances; (4) the distributor’s past

experience with controlled substances; and (5) “such other

factors as may be relevant to and consistent with the public

health and safety.” 21 U.S.C. § 823(b), (e). The Administrator

is “not required to make findings as to all of the[se] factors,”

and “may give each factor the weight he deems appropriate.”

Morall v. DEA, 412 F.3d 165, 173-74 (D.C. Cir. 2005) (internal

quotation marks omitted). If the distributor’s operations fail to

live up to the public-interest standard, the Administrator may

“suspend[] or revoke[]” the distributor’s certificate. 21 U.S.C.

§ 824(a)(4).

Where, as here, the Administrator considers the first

factor—the maintenance of “effective controls” against the

“diversion” of controlled substances—the Administrator must

determine whether the registrant complied with DEA’s

“security requirements.” 21 C.F.R. § 1301.71(a). The

“security requirement” at the heart of this case mandates that

distributors “design and operate a system” to identify

“suspicious orders of controlled substances” and report those

orders to DEA (the Reporting Requirement). 21 C.F.R.

§ 1301.74(b). The Reporting Requirement is a relatively

modest one: It requires only that a distributor provide basic

information about certain orders to DEA, so that DEA

“investigators in the field” can aggregate reports from every

5

point along the legally regulated supply chain and use the

information to ferret out “potential illegal activity.”

Southwood Pharm., Inc., 72 Fed. Reg. 36,487, 36,501 (Drug

Enf’t Admin. July 3, 2007). Once a distributor has reported a

suspicious order, it must make one of two choices: decline to

ship the order, or conduct some “due diligence” and—if it is

able to determine that the order is not likely to be diverted into

illegal channels—ship the order (the Shipping Requirement).

See id. at 36,500.

B.

On October 17, 2008, a DEA Deputy Assistant

Administrator issued an order to show cause why DEA should

not revoke Masters’ certificate of registration (the 2008 Order

to Show Cause, or 2008 Order). U.S. Dep’t of Justice, Drug

Enf’t Admin., Order to Show Cause (Oct. 17, 2008). That

Order alleged that Masters had “failed to maintain effective

controls against diversion” of hydrocodone, a powerful opioid.

Id.; see also Masters Pharm., Inc., 80 Fed. Reg. 55,418, 55,421

(Drug Enf’t Admin. Sept. 15, 2015). “Throughout 2007 and

2008,” Masters violated the Reporting Requirement by failing

to notify DEA when “rogue Internet pharmacies” placed

suspicious hydrocodone orders. 80 Fed. Reg. at 55,421-22. In

addition, Masters allegedly filled those hydrocodone orders

without performing adequate due diligence, in violation of the

Shipping Requirement. See 80 Fed. Reg. at 55,421-22.

On April 1, 2009, DEA and Masters agreed to settle the

charges in the 2008 Order. The settlement agreement required

Masters to pay $500,000 to the agency and bring the company

into compliance with DEA regulations by implementing a

compliance system “to detect suspicious orders” for controlled

substances and “prevent diversion of controlled substances”

into illegal channels. Settlement and Release Agreement and

6

Administrative Memorandum of Agreement at 2 (Apr. 1,

2009), J.A. 899. Masters further promised that orders

“identified as suspicious” by the compliance system would “be

reported to . . . DEA.” Id.

To fulfill its obligations under the settlement agreement,

Masters created a compliance system called the “Suspicious

Order Monitoring System” or “SOMS,” consisting of a

computer program (the Computer Program) and a protocol for

Masters’ employees (the Compliance Protocol, or Protocol).

The Computer Program was designed to identify any order for

controlled substances that “me[t] or exceed[ed]” the criteria for

suspicious orders set out in 21 C.F.R. § 1301.74(b). J.A. 1436.

In other words, the computer program was designed to identify

orders of an unusual “size,” “frequency,” or “pattern.” 21

C.F.R. § 1301.74(b). Thus, for each of the controlled

medications that Masters sold, the Computer Program tracked

the number of doses that Masters’ customers ordered over the

preceding six calendar months. Each customer’s highest

monthly total would then be treated as the customer’s

“Controlled Substance Limit.” 80 Fed. Reg. at 55,423 n.12;

see also J.A. 1395-96. If a customer ordered enough doses in

any 30-day period to exceed its Controlled Substance Limit,

the Computer Program would hold the customer’s most recent

order for the medication so it could be reviewed by Masters’

staff. The Computer Program also held the most recent order

placed by a customer if the customer submitted more order

forms in a 30-day period than it had in any of the prior six

calendar months, or if the timing of the order did not comport

with the customer’s general ordering pattern over those six

months. J.A. 1397.

Once an order was held, Masters’ staff would implement

the SOMS Protocol, which required Masters’ staff to take

specified steps to investigate the order and determine whether

7

it was legitimate. The SOMS Protocol required Masters’ staff

to initiate the investigation by “call[ing] the customer” that

placed the held order, “request[ing] . . . [a]n explanation,”

documenting the customer’s response, and then “independently

verify[ing]” the information that the customer provided.

J.A. 1213, 1436. In addition, Masters’ staff was required to

obtain a “current utilization report” from the ordering

pharmacy—i.e., a list all of the controlled and non-controlled

medications that the pharmacy dispensed in the most recent

calendar month. Id. at 1436. Masters’ employees would then

“examine[]” the pharmacy’s “entire file,” including its order

history, survey responses, and records of any “site visit[s]”—

i.e., occasions on which Masters’ staff physically observed

customers’ premises for signs that they participated in the black

market, id. at 1436, 1441, such as a long line of customers

awaiting prescriptions at an odd time of day, 80 Fed. Reg. at

55,484, or multiple cars in the pharmacy parking lot with out-

of-state license plates, id. at 55,490. If the customer provided

all of the information that Masters’ staff requested, and Masters

determined that: (a) the held order was “consistent with the

customer’s utilization report”; and (b) the “customer’s entire

file, including survey responses and site visits, [was] consistent

with legitimate business practices,” Masters’ staff could deem

the order non-suspicious and ship it. J.A. 1436. Otherwise,

Masters would treat the order as “suspicious,” report it to DEA

as required by 21 CFR 1301.74(b), and decline to fill it.

In the four years after Masters signed the Settlement

Agreement, DEA grew concerned that Masters’ staff was

failing to detect and report to DEA suspicious orders of

oxycodone products, in violation of 21 C.F.R. 1301.74(b). On

August 9, 2013, a Deputy Assistant Administrator of DEA

issued a second order to show cause why Masters’ certificate

of registration should not be revoked (the 2013 Order to Show

Cause, or 2013 Order), alleging that “Masters consistently

8

ignored and/or failed to implement” its controlled substance

policies and failed to comply with the Reporting Requirement.

U.S. Dep’t of Justice, Drug Enf’t Admin., Order to Show Cause

(Aug. 9, 2013), J.A. 10. The 2013 Order further alleged that

Masters violated the Shipping Requirement by filling orders for

millions of dosage units of oxycodone for eight illegitimate

pharmacies in Florida and Nevada: Tru-Valu Drugs; The Drug

Shoppe; Medical Plaza Pharmacy; Englewood Specialty

Pharmacy; City View Pharmacy; Lam’s Pharmacy; Morrison’s

RX; and Temple Terrace Pharmacy, doing business as Superior

Pharmacy.

Administrative Law Judge Gail Randall (the ALJ) tried the

noncompliance allegations. She first concluded that Masters

had substantially complied with the Reporting Requirement.

From her perspective, Masters had a duty to report an order

held by the Computer Program only if Masters’ staff

determined that the pharmacy placing the order was “likely

diverting controlled substances.” Recommended Findings of

Fact, Conclusions of Law, and Decision of ALJ, Masters

Pharm., Inc., No. 13-39, at 156 (June 19, 2014) (ALJ

Decision). She thought Masters had shirked that duty on only

one occasion, and that failure to report a single suspicious order

did not warrant revocation of Masters’ certificate of

registration. Id. at 201.

For similar reasons, the ALJ also concluded that Masters

had substantially complied with the Shipping Requirement.

The ALJ held that, under the Shipping Requirement, a

pharmaceutical distributor like Masters could ship an order for

controlled substances if it conducted enough due diligence to

guard against any likelihood that the order would be diverted

into unlawful channels. ALJ Decision at 201 (quoting

Southwood, 72 Fed. Reg. at 36,502). And Masters’

9

investigation into orders held by the Computer Program was,

in her view, sufficient to satisfy that standard.

In an eighty-three page Decision and Order published in

the Federal Register, the Acting Administrator rejected the first

part of the ALJ’s recommendation, and concluded that Masters

had repeatedly violated the Reporting Requirement. The

Administrator explained that the ALJ’s suspicious-order

analysis was legally flawed because it misapprehended the

“standard for reporting an order as suspicious.” 80 Fed. Reg.

at 55,478. The ALJ insisted that an order was suspicious only

if Masters had found it “likely” that the order would be diverted

away from legitimate medical or scientific channels, but the

amount of evidence needed to raise a “suspicion” is “far lower”

than the amount of evidence needed to show that something is

“likely.” Id. A suspicion is merely “[t]he apprehension or

imagination of the existence of something wrong based . . . on

inconclusive or slight evidence.” Id. (quoting Black’s Law

Dictionary 1,585 (9th ed. 2009)). With that definition in mind,

the Administrator reviewed Masters’ SOMS manual and

determined that any order held by the Computer Program was

held due to its unusual size, frequency, or pattern, and DEA

regulations expressly provide that deviations in size,

frequency, or pattern are the sort of indicia that give rise to a

suspicion and, unless the suspicion is dispelled, the obligation

to report. See id. at 55,479; 21 C.F.R. § 1301.74(b).

The record evidence showed that, on hundreds of

occasions, Masters neither reported orders held by the SOMS

Computer Program nor implemented the SOMS Protocol to

dispel the suspicion surrounding held orders. For example, on

numerous occasions, rather than conducting the investigation

contemplated by the Protocol, Masters’ employees deleted held

orders or reduced their size so that they would no longer trigger

the hold. At other times, Masters’ employees did contact their

10

customers to obtain explanations for held orders, but simply

accepted whatever the pharmacies told them, without taking (or

documenting) requisite steps to determine whether the

explanations were accurate or even plausible. Perhaps most

problematically, when customers provided information that

confirmed the suspicion surrounding orders held by the SOMS,

Masters still failed to report the orders to DEA. The

Administrator ultimately concluded that Masters’ frequent

violations of the Reporting Requirement warranted revocation

of Masters’ certificate of registration; he therefore had no need

to consider whether Masters additionally violated the Shipping

Requirement.

II.

Masters claims that the Administrator’s key factual

findings are unsupported by the record. As Masters

acknowledges, we must accept the Administrator’s findings so

long as they are supported by “substantial evidence.” 21

U.S.C. § 877. The substantial evidence test is “[h]ighly

deferential to the factfinder,” New Valley Corp. v. Gilliam, 192

F.3d 150, 154 (D.C. Cir. 1999), requiring only such evidence

that a “reasonable mind might accept as adequate to support a

conclusion,” S.C. Pub. Serv. Auth. v. FERC, 762 F.3d 41, 54

(D.C. Cir. 2014) (quoting Murray Energy Corp. v. FERC, 629

F.3d 231, 235 (D.C. Cir. 2011)). We cannot reverse the

Administrator’s factual findings even if, had we been in his

position, we “would have weighed the evidence differently.”

Cumberland Coal Res., LP v. Fed. Mine Safety & Health

Review Comm’n, 717 F.3d 1020, 1028 (D.C. Cir. 2013).

Accepting that we view the Administrator’s factfinding

deferentially, Masters still sees insufficient evidence to support

some of his factual conclusions. Masters contends that the

record contains inadequate evidence to support the

11

Administrator’s conclusions that: (1) whenever an order for

controlled substances was held by the SOMS Computer

Program, that order was presumptively “suspicious” under 21

C.F.R. § 1301.74(b); and (2) Masters’ employees rarely

undertook the investigation required to dispel the suspicion

surrounding held orders. After full consideration of the parties’

briefs and arguments, and examination of the record and the

careful and detailed decisions of the ALJ and the

Administrator, we believe the Administrator’s conclusions are

well founded.

A.

Masters first challenges the Administrator’s conclusion

that any held order was suspicious under 21 C.F.R.

§ 1301.74(b)—at least unless Masters dispelled the suspicion

through investigation. That conclusion, Masters insists, is

inconsistent with the language of Masters’ Comprehensive

Compliance Policy Manual, which provides that the Computer

Program will flag all orders that have even the potential to be

suspicious. According to Masters, the Manual contemplates

that the Computer Program will “hold[] every order that is

suspicious as defined in 21 C.F.R. § 1301.74(b),” as well as

“many orders that are not suspicious.” Pet’r Br. 33. As a result,

Masters insists, an order will “only be deemed” suspicious

under Masters’ policies if it is held by the Computer Program

and a Masters employee follows up and separately makes a

determination that it is suspicious. Pet’r Br. 34-35.

As an initial matter, Masters offers a strained reading of its

Comprehensive Compliance Policy and Manual. The manual

expressly states that the Computer Program “[h]olds all orders

for controlled drugs that meet or exceed the [suspicious order]

criteria set out in 21 C.F.R. § 1301.74(b)”—rather than orders

that potentially meet or exceed those criteria. J.A. 1436. In

12

other words, the Computer Program was designed to hold

orders that are suspicious within the meaning of the regulation,

even as it gave Masters’ employees the opportunity—through

the due-diligence investigation contemplated by the

Compliance Protocol—to dispel the suspicion surrounding

held orders.

More fundamentally, the key question in this case is not

whether held orders qualified as “suspicious” under Masters’

policies; the question is whether they qualified as “suspicious”

under 21 C.F.R. § 1301.74(b). Thus, while Masters frames its

challenge on this point in substantial-evidence terms, the

relevant inquiry is more legal than factual: It asks how far the

language of the regulation reaches. Undertaking that legal

exercise, the Administrator reasonably determined that all held

orders were “suspicious” within the meaning of the regulation.

Section 1301.74(b) provides that “[s]uspicious orders include

orders of unusual size, orders deviating substantially from a

normal pattern, and orders of unusual frequency.” Apparently

tracking that regulatory language, the Computer Program held

an order if: (a) that order—combined with other orders placed

in the same 30-day period—requested more doses of a

controlled medication than the pharmacy had requested in any

of the previous six calendar months; (b) the pharmacy ordered

a controlled medication more frequently in a 30-day period

than it had in any of the previous six calendar months; or (c)

the pharmacy’s ordering pattern for a controlled medication

deviated in some other notable way from its ordering pattern

over the previous six months. As a matter of common sense

and ordinary language, orders that deviate from a six-month

trend are an “unusual” and not “normal” occurrence. It was

therefore entirely reasonable for the Administrator to hold that

orders held by the Computer Program met the regulatory

definition of “suspicious orders” unless Masters’ staff dispelled

the suspicion. 80 Fed. Reg. at 55,479 n.164; see Auer v.

13

Robbins, 519 U.S. 452, 461 (1997) (explaining that courts must

defer to an agency’s reasonable interpretations of its own

regulations).

Finally, Masters contends that it is impossible to identify

whether a held order is suspicious within the meaning of DEA

regulations until a Masters employee has completed the SOMS

Protocol. But if we were to credit Masters’ assertion that “the

SOMS . . . holds many orders that are not suspicious,” Pet’r Br.

33, it would be even clearer that Masters failed to “operate” a

“system” for sorting suspicious from non-suspicious orders, in

violation of 21 C.F.R. § 1301.74(b). By taking the position that

orders initially held by the SOMS Computer Program are not

thereby identified as suspicious, Masters’ case that it complied

rests entirely on whether the company carried out some other

process that would identify suspicious orders. The process

Masters contends it used to do that is the SOMS Protocol.

Under that theory, an order can only be suspicious once an

employee has run the SOMS Protocol from beginning to end.

But, as the next section describes, the record contains

overwhelming evidence that Masters’ employees routinely

failed to implement the SOMS Protocol.

B.

Masters also contends that there is insufficient evidence to

support the Administrator’s finding that Masters repeatedly

failed to report orders held as suspicious, or to conduct the sort

of investigation that could dispel the suspicion that such orders

were at risk of diversion. We conclude that, to the contrary, the

Administrator’s decision contains ample support for his

specific findings of Masters’ failures, in violation of the

regulations, to report suspicious orders.

More particularly, as noted above, when the Computer

Program held an order, Masters’ written Compliance Protocol

14

required that a Masters employee call the pharmacy that placed

the order, request an explanation and a current utilization

report, and conduct an investigation to independently verify the

pharmacy’s information and explanation. J.A. 1436.

According to the written testimony of Wayne Corona, a full-

time consultant for Masters who helped develop the SOMS, the

Compliance Protocol required the investigating employee to

document the results of his or her inquiry “in the due diligence

file[]” for the pharmacy that placed the order, “specifically in

the Memos for Record (‘MFR’).” J.A. 1213. Indeed, Corona

emphasized that “documentation was the linchpin of th[e]

whole system.” 80 Fed. Reg. at 55,427 n.19. In light of the

essential documentation requirements, the Administrator

scoured Masters’ files on the Florida-based pharmacies listed

in the 2013 Order to Show Cause in an effort to discern what

Masters’ staff had done to verify that held orders were not

suspicious and so need not be reported.

Those files are replete with evidence that Masters

routinely failed to investigate held orders. Most strikingly, in

lieu of reporting all held orders, Masters’ employees deleted

some and edited others so that they appeared to be of a normal

size and pattern, and then proceeded to fill them. While

deleting or editing orders may have limited the amount of

oxycodone flowing to Masters’ customers, that practice

subverted the Reporting Requirement. The law requires

registered suppliers like Masters to alert DEA when their retail-

pharmacy customers attempt to obtain unusual amounts of a

controlled substance, because such attempts are powerful

evidence that the pharmacies are operating illegally.

In other instances, Masters’ employees simply released

orders from hold and filled them as written, again without

reporting them to DEA or investigating to see whether they

might dispel the suspicion that caused the order to be placed on

15

hold. For many of those orders, Masters had no record that any

employee even took the initial investigative step of calling the

ordering pharmacy. Records were absent despite Masters’

representation to DEA that “[d]ocumentation on all orders held

for review and their disposition are permanently retained.” 80

Fed. Reg. at 55,428. As the Administrator noted, the lack of

documentation was evidence that the phone calls never took

place: “The absence of an entry [in business records], where

an entry would naturally have been made if a transaction had

occurred, should ordinarily be equivalent to an assertion that

no such transaction occurred, and therefore should be

admissible in evidence for that purpose.’’ Id. (quoting 5

Wigmore, Evidence § 1531, at 463 (Chadbourn rev. 1974)

(emphasis added)).

Even when Masters’ employees took some steps to probe

the reasons orders were held, their efforts were too tentative,

pro forma, and incomplete to dispel suspicion, yet Masters

failed to report the orders to DEA. Many of Masters’ files

contain entries suggesting that a Masters employee called a

pharmacy to request an explanation for a held order, but either

failed to obtain any explanation or, if it got one, to make

corresponding entries showing that the employee verified that

explanation. In Masters’ file for City View pharmacy, for

example, there are notes documenting Masters’ repeated calls

to the pharmacy, see 80 Fed. Reg. at at 55,494, and notes

documenting City View’s assertion that it needed large

amounts of oxycodone because it was “servicing two small

nursing homes and was near a medical center.” Id. at 55,493.

But there is no record that a Masters employee “even obtain[ed]

the names of the homes, let alone inquire[d] as to how many

residents they had.” Id. Similarly, Masters determined that

Superior Pharmacy had justified its request for large amounts

of oxycodone because “Superior was filling prescriptions for a

juvenile in-patient facility. However, [Masters] obtained no

16

information as to the type of treatment being provided by the

facility, the number of patients it had, and whether its patients

would even be treated with drugs such as oxycodone 30.” Id.

at 55,499 (internal quotation marks omitted). In the same vein,

Masters accepted Medical Plaza’s claim that it was ordering

large amounts of oxycodone in part because it was “[i]n a

medical building of 60 doctors,” without conducting any

“inquiry into the practice specialties of these physicians and

whether they would be prescribing such powerful narcotics as

oxycodone 30 in the course of their medical practices.” Id. at

55,458, 55,495 (internal quotation marks and brackets

omitted).

What limited investigative records Masters maintained

also show that Masters’ employees rarely got customers’ recent

utilization reports to place held orders in context. Without

those reports (or some comparable information), Masters could

not know what proportion of a pharmacy’s prescription

business was controlled substances. It therefore could not

confirm that the pharmacy’s dispensing practices were

consistent with those of a legitimate business.

Further, Masters’ records show that investigations into

held orders often ended with an employee recording a

demonstrably false explanation for the order, or with the

employee’s harboring unresolved doubts about the order’s

validity, yet failing to share those doubts with DEA. For

instance, Masters’ employees often concluded that an order for

controlled substances was justified because it was consistent

with the pharmacy’s utilization report, even where there was

no current utilization report on file or when the utilization

report showed “highly suspicious” dispensing patterns. See,

e.g., id. at 55,486, 55,500. In other cases, Masters’ employees

said that orders were justified because they were within the

Controlled Substance Limit established by the SOMS

17

computer program, despite the fact that the orders had been

held because they violated that limit. See id. at 55,500.

Finally, Masters’ employees frequently ended their

investigations by noting that they were filling controlled

substance orders “with reservation.” See, e.g., 80 Fed. Reg. at

55,427, 55,432-33, 55,437-38, 55,448, 55,459. Such

“reservation[s]” suggest that Masters’ employees were

dissatisfied with the explanations they received for particular

controlled substance orders. Yet they repeatedly failed to

report those orders to DEA. See id.

Masters urges us to disregard the overwhelming evidence

that it failed to conduct meaningful investigations into held

orders, pointing to some contrary evidence in the record. In

particular, Jennifer Seiple, Masters’ chief compliance officer,

testified that Masters investigated all orders held by the

Computer Program (even orders it edited or deleted). But the

Administrator carefully considered evidence that Masters cited

in its favor, including Ms. Seiple’s testimony, and found that

the evidence was either implausible or unresponsive to the

government’s evidence. See, e.g., 80 Fed. Reg. at 55,420 n.5,

55,471 n.152, 55,483 n.174.

In sum, the Administrator painstakingly explained the

factual bases for his conclusions. He found that, when SOMS

held an order, Masters routinely neither reported to DEA nor

took even a single investigative step. Faced with orders that

were suspicious for the core reasons in the regulation—unusual

size, pattern, or frequency—Masters’ employees frequently

simply brushed suspicion under the rug by deleting orders or

paring them down and shipping them without reporting them

to DEA. They also, time and again, simultaneously

acknowledged their own concerns while behaving in ways that

ensured those concerns would not be addressed: They filled

18

suspicious orders with expressed “reservations,” without

notifying DEA. On occasions when Masters took a stab at

investigating in response to a SOMS hold, it accepted, without

seeking to verify, the half-baked or implausible explanations

its customers supplied. We have considered each of Masters’

challenges to the sufficiency of the evidence. Our review gives

us no ground to disturb the Administrator’s carefully

documented conclusions. See Cumberland Coal Res., LP, 717

F.3d at 1028.

III.

Masters further contends that the Administrator’s decision

effectively amended existing DEA rules in violation of the

APA. When an agency creates rules on a blank slate, it

generally has the option of choosing whether to establish new

policies through notice-and-comment rulemaking or

adjudication. See, e.g., POM Wonderful, LLC v. FTC, 777 F.3d

478, 497 (D.C. Cir. 2015) (“[T]he choice between rulemaking

and adjudication lies in the first instance within the agency’s

discretion.” (quoting Cassell v. FCC, 154 F.3d 478, 486 (D.C.

Cir. 1988))). But Masters contends that, once an agency

promulgates a rule following public notice and comment, it

may not amend or repeal the rule in an administrative

adjudication. See Pet’r Br. 49 (citing Marseilles Land & Water

Co. v. FERC, 345 F.3d 916, 920 (D.C. Cir. 2003)). In Masters’

view, the Administrator amended two notice-and-comment

rules in adjudicating this case: 21 C.F.R. § 1301.74(b) (the

regulation defining suspicious orders) and 21 C.F.R.

§ 1301.71(a) (the regulation defining effective controls against

the diversion of controlled substances). We need not opine on

DEA’s statutory authority to use an adjudication to modify a

rule enacted through notice and comment because the

Administrator neither created nor imposed any new duties. He

relied on the existing Reporting Requirement.

19

A.

As already noted, section 1301.74(b) defines

“[s]uspicious” orders to “include orders of unusual size, orders

deviating substantially from a normal pattern, and orders of

unusual frequency.” 21 C.F.R. § 1301.74(b). According to

Masters, the rule creates an exhaustive list of the characteristics

that make an order for controlled substances suspicious, so that

the Administrator could not treat an order as “suspicious” for

any reason other than its size, pattern, or frequency without

effectively expanding the rule. For example, the Administrator

pointed to the fact that several pharmacies mostly sold

controlled substances, rather than the mix of controlled and

non-controlled medications typical for a bona fide retail

pharmacy, as among the indicia that the pharmacy might be

involved in illegal diversion. See, e.g, 80 Fed. Reg. at 55,484

(Administrator explaining that orders placed by Tru-Valu

pharmacy were suspicious, in part because 60 to 80 percent of

Tru-Valu’s medication sales were for controlled substances);

id. at 55,488 (Administrator explaining that orders placed by

Englewood Specialty Pharmacy were suspicious, in part

because “controlled substances prescriptions comprised nearly

70 percent of all prescriptions the pharmacy dispensed”); id. at

55,491-94 (Administrator explaining that orders placed by City

View Pharmacy were suspicious, in part because “60 percent

of the prescriptions filled by the pharmacy were for controlled

substances”). The Administrator also concluded that several

orders were suspicious because an unusually high percentage

of the pharmacy’s customers paid for controlled substances

with cash (the preferred payment method for illegitimate

prescriptions), rather than traceable methods such as credit

cards or health insurance. See id. at 55,488 (Administrator

explaining that orders placed by The Drug Shoppe were

suspicious, in part because “85 percent of the controlled

substance prescriptions it filled were paid for with cash”); id.

20

at 55,484 (Administrator explaining that orders placed by Tru-

Valu pharmacy were suspicious, in part because Tru-Valu did

not accept insurance for all of its oxycodone products).

Similarly, orders from pharmacies that bought oxycodone from

Masters at a price higher than insurance would reimburse, but

did not also sell enough other medications or products to offset

such losses, raised suspicions that they sold oxycodone to the

black market at a higher price. See id. at 55,494 (Administrator

explaining that orders placed by City View Pharmacy were

suspicious, in part because Masters’ staff had documented

concerns about the pharmacy’s ability to “ma[k]e a profit”); id.

at 55,497 (Administrator explaining that orders placed by

Medical Plaza Pharmacy were suspicious, in part because it

was not clear “how the pharmacy could be making a profit

when insurance reimbursed at a lower rate ($32) than what

Master[s] charged for oxycodone ($39)”).

Contrary to Masters’ suggestion, the Administrator did not

impermissibly amend section 1301.74(b) when it held that the

rule does not exhaustively list characteristics that might make

a retail pharmacy’s order for large quantities of controlled

substances “suspicious.” See 80 Fed. Reg. at 55,473-74.

Section 1301.74(b) defines suspicious orders as “includ[ing]”

orders of an unusual size, pattern, or frequency, and it is well

established that the word “include” often precedes a list of

“illustrative” examples, rather than an exclusive list of indicia

of an identified wrong. Fed. Land Bank of St. Paul v. Bismarck

Lumber Co., 314 U.S. 95, 99-100 (1941); accord Alabama v.

North Carolina, 560 U.S. 330, 340-41 (2010). The

Administrator noted that Masters’ reading of section

1301.74(b) “would have ill-served the CSA’s purpose of

preventing the ‘illegal . . . distribution . . . possession and

improper use of controlled substances’” by failing to require

the reporting of an order so long as it was of typical size,

pattern, or frequency, even if a supplier actually knew “that a

21

customer was ordering controlled substances from it for the

purpose of diverting them.” 80 Fed. Reg. at 55,473 (quoting

21 U.S.C. 801(2)). Reading section 1301.74(b)’s listed

characteristics as exemplary rather than exhaustive, DEA

reasonably concluded that other indicia may also raise

suspicions about an order for controlled substances. That

conclusion was entirely consistent with the text of the

regulation, as well as agency precedent. See, e.g., Southwood,

72 Fed. Reg. at 36,497, 36,501-02 (internet pharmacy’s orders

were suspicious because the pharmacy was buying an unusual

mix of controlled and non-controlled substances, dominated

overwhelmingly by controlled substances, which was not

consistent with what legitimate pharmacies typically ordered);

id. at 36,501 (supplier should have reported pharmacy’s orders

as suspicious after the supplier’s agent visited the pharmacy

and saw signs relating to mail-order business tied to an internet

pharmacy that mailed prescriptions out of state, suggesting that

the pharmacy was “filling . . . illegitimate prescriptions”).

B.

Second, Masters argues that the Administrator

impermissibly amended section 1301.71(a) without notice and

comment. That section imposes a general duty on

pharmaceutical distributors to “provide effective controls . . .

against [the] diversion” of controlled substances. 21 C.F.R.

§ 1301.71(a). The regulation requires the Administrator to

“use the security requirements set forth in §§ 1301.72-1301.76

as standards for the physical security controls and operating

procedures necessary to prevent diversion.” Id. Thus, in

Masters’ view, sections 1301.72 through 1301.76 set out the

only standards the agency may use to measure the effectiveness

of controls against diversion:

22

These specifically enumerated “physical security

controls and operating procedures” do not require a

distributor to perform due diligence on its customers;

the only requirement is that distributors make a

“good faith inquiry” to verify that a customer has a

valid DEA and state registration. Id. § 1301.74(a).

Distributors also have an obligation to identify and

report to DEA “suspicious orders,” which “include

orders of unusual size, orders deviating substantially

from a normal pattern, and orders of unusual

frequency.” Id. § 1301.74(b).

Pet’r Br. 46. Masters insists that the Administrator unlawfully

used this proceeding to create new legal obligations by

expansively reading existing law. Foremost, Masters

complains that the Administrator elaborated on the Shipping

Requirement. As noted above, the Shipping Requirement

mandates that pharmaceutical companies exercise “due

diligence” before shipping any suspicious order. 72 Fed. Reg.

at 36,500. DEA first articulated that requirement in

Southwood, 72 Fed. Reg. at 36,501, and Masters claims that the

Administrator expanded on it here. See 80 Fed. Reg. 55,476.

First in Southwood and then in this case, Masters contends, the

Administrator amended the regulatory scheme by tacking the

Shipping Requirement onto the settled list of “security

requirements” stated in sections 1301.72–1301.76.

Notably, however, the Administrator’s holding rests on

Masters’ violation of the Reporting Requirement, not the

Shipping Requirement. The Administrator’s Decision and

Order summarized his reasoning and “conclude[d] that

[Masters] ha[d] not substantially complied with 21 CFR [§]

1301.74(b)”—the Reporting Requirement. 80 Fed. Reg. at

55,500-01. Consequently, even if the Administrator

expansively read the Shipping Requirement, that reading had

23

no effect on his ultimate decision, and so provides no basis for

relief. See 5 U.S.C. § 706.

Similarly, Masters insists that the Administrator used this

proceeding to create a handful of highly specific security

requirements that are unrelated to the Shipping Requirement.

Specifically, Masters protests that the Administrator

announced that

[1] “[A] distributor must use the URs in evaluating

whether a customer’s [ratio of controlled to non-

controlled drug sales] is suspicious” (JA 555); [2]

“[e]ven if the Agency’s regulations do not require a

distributor to document the reason provided by a

customer to justify a suspicious order, documenting

that reason is still an essential part of maintaining

effective controls . . .” (JA 563 n.21); . . . [3] “the

distributor must conduct ‘additional investigation to

determine whether [its customer is] filling legitimate

prescriptions’” (JA 612) . . . ; and [4] “investigation

[into a suspicious order] must dispel all red flags

indicative that a customer is engaged in diversion

. . .” (JA 613).

Pet’r Br. 47-48.

Contrary to Masters’ suggestion, however, none of those

statements created new security requirements. Rather, the

statements collectively explained what a distributor in Masters’

position must do if, instead of immediately reporting to DEA

all orders of an unusual size, frequency, or pattern, it chooses

to use the SOMS—or an equivalent program—to seek to dispel

the suspicion surrounding such orders and report only those

that still appear suspicious after investigation. As we have

emphasized throughout this opinion, it is not necessary for a

distributor of controlled substances to investigate suspicious

24

orders if it reports them to DEA and declines to fill them. But

if a distributor chooses to shoulder the burden of dispelling

suspicion in the hopes of shipping any it finds to be non-

suspicious, and the distributor uses something like the SOMS

Protocol to guide its efforts, then the distributor must actually

undertake the investigation. For example, when an employee

uses the SOMS Protocol to confirm or dispel suspicion based

on the amount of controlled medication the pharmacy is selling,

the employee must request a “UR,” i.e., a document showing

the pharmacy’s “actual dispensing[s] . . . of each drug.” 80

Fed. Reg. at 55,420. Moreover, the investigating employee

must “document” customers’ explanations for suspicious

orders, so that he or she can verify those explanations and make

sure they are consistent over time. Id. at 55,428 n.21.

Additionally, if a customer’s explanation for its order is

“inconsistent with other information the [investigator] has

obtained about or from the customer, . . . the [investigator]

must conduct ‘additional investigation to determine whether

[its customer is] filling legitimate prescriptions.’” Id. at

55,477. Finally, the investigation must dispel all of the “red

flags” that gave rise to the suspicion that the customer was

diverting controlled substances. Id. at 55, 478. The

Administrator recognized that, if investigating employees fail

to take such basic steps, the SOMS (or similar protocol) does

not function as an effective tool for dispelling suspicion.

IV.

Next, Masters contends that the Administrator’s decision

violates its rights under the 2009 Settlement Agreement with

DEA. In that agreement, DEA released Masters from liability

and agreed to refrain from filing new administrative claims

against it based on conduct alleged in the agreement and the

2008 Order to Show Cause, all of which occurred before April

1, 2009. J.A. 898-99. DEA also committed to reviewing

25

Masters’ “diversion compliance program” (i.e., the SOMS)

within the first 180 days that the Settlement Agreement was in

effect to determine whether it satisfactorily guarded against

diversion. Id. at 901-02. Masters contends that DEA reneged

on both of those promises, so cannot now rely on Masters’ pre-

April 2009 conduct or inadequacies in the SOMS to support its

revocation of Masters’ certificate of registration.

A.

Masters asserts that it is being penalized for failing to

report suspicious orders placed before April 1, 2009, in

violation of the Settlement Agreement. See J.A. 899. As

Masters notes, the Administrator repeatedly cited Masters’ pre-

April 2009 interactions with customers. The Administrator,

however, only referred to those interactions to demonstrate

Masters’ knowledge of its customers’ suspicious business

practices, which should have prompted Masters to be

especially scrupulous in reporting suspicious orders placed by

those customers after April 1, 2009. For example, the

Administrator noted that, in September 2008, Englewood

Specialty Pharmacy requested that Masters increase its

oxycodone purchasing limit. 80 Fed. Reg. at 55,488. In

making that request, Englewood’s staff told Masters that 30 per

cent of the prescriptions it filled were for controlled

substances—a figure belied by Englewood’s then-current

utilization report showing that nearly 70 per cent of the

prescriptions Englewood filled were for controlled

medications. Id. Just two months later, in November 2008,

Masters sent a consultant to visit Englewood, who reported that

Englewood “appear[ed] to be doing a larger narcotic business

than [it] admit[ed].” Id. at 55,488-89. In light of the strong

evidence that Englewood had a history of lying to Masters to

obtain narcotics, the Administrator concluded that Masters

should have reported as suspicious Englewood’s unusually

26

large post-settlement-period orders for oxycodone. See id.

That conclusion was entirely consistent with the Settlement

Agreement. J.A. 903 (reserving DEA’s right to admit evidence

of pre-settlement conduct “for proper evidentiary purposes” to

establish Masters’ liability “for non-covered conduct”).

B.

Masters also claims that it detrimentally relied on DEA’s

commitment to review the SOMS and inform Masters if it

found either component of the SOMS (the Computer Program

or the Compliance Protocol) to be inadequate. As noted above,

DEA represented in the Settlement Agreement that, within 180

days of the agreement’s April 1, 2009, effective date—i.e., by

July 30, 2009—DEA would visit Masters’ “distribution center”

and “conduct a review of the functionality of Master[s]’

diversion compliance program” (the Compliance Review).

J.A. 901-02. DEA further represented that, “[a]t the conclusion

of the Compliance Review, DEA [would] conduct an exit

interview with appropriate Masters representatives to provide

DEA’s preliminary conclusions regarding the Compliance

Review.” Id. at 902. Finally, DEA agreed that, if the

Compliance Review was unsatisfactory, DEA would

“provide[] written notice with specificity to Masters on or

before 220 days from the [e]ffective [d]ate of [the Settlement

Agreement].” Id.

It is undisputed that the Compliance Review did not

completely fulfill the parties’ expectations. “[B]ecause the

new policies had been implemented on August 14, 2009, only

four days before the Compliance Review, there was not enough

time to determine if the policies were being properly

implemented.” 80 Fed. Reg. at 55,425. DEA nonetheless

conducted a Compliance Review on August 17 and 18, 2009.

DEA’s Diversion Investigators provided Masters’ personnel

27

some training regarding distributors’ obligations under the

Controlled Substances Act, discussed specific concerns about

certain of Masters’ past practices and customers and warned

Masters not to continue such dealings, and gave some

additional guidance on how to detect illegitimate dispensing of

controlled substances. Id. at 55,422-23. Masters, for its part,

briefed the investigators on its drug handling policies and

procedures, including its SOMS. Id. at 55,423-25. The SOMS

had been put in place so recently that neither party could rely

on the formal “exit interview” contemplated by the Settlement

Agreement as assurance that the SOMS, as Masters actually

operated it, brought the company into compliance with its

obligations under the Controlled Substances Act. Id. at 55,425.

Instead, what an investigator told Masters was that its written

“policies and procedures” for the SOMS, “if properly

implemented” by Masters’ personnel, “could promote an

effective system to detect and prevent diversion of controlled

substances.” Id.

According to Masters, much of the conduct on which the

Administrator relied in these proceedings should have been

apparent to DEA investigators during the Compliance Review.

Because Masters did not receive the written notice that DEA

promised to provide if it found the Compliance Review to be

“not satisfactory,” J.A. 902, and because of “DEA’s silence

following the Compliance Review,” Masters says that it

presumed that it was operating within the letter of the law.

Pet’r Br. 53-59. Masters therefore asserts that it was deprived

of a key benefit of the Settlement Agreement: an opportunity

to correct any shortfalls in its controlled substances program

before they triggered administrative action to revoke its

certificate. Masters contends that DEA is contractually bound

and equitably estopped from holding it responsible for any

deficiencies in the SOMS of which the agency did not

previously notify Masters in writing. See id. at 57-59.

28

As the Administrator noted, the Settlement Agreement

provided no remedy for Masters in the event that DEA failed

to provide written notice of any observed deficiencies in

Masters’ SOMS; the key question is thus whether, in light of

the Settlement, DEA should be equitably estopped from

holding Masters to account for inadequacies in its diversion-

detection policies and practices that, according to Masters,

were reasonably observable in 2009 but not identified by DEA

in the Compliance Review. See J.A. 564 (citing Dantran, Inc.,

v. U.S. Dep’t of Labor, 171 F.3d 58, 66 (1st Cir. 1999) (holding

that an agency was not equitably estopped from imposing

liability on a party who relied on a “clean bill of health” from

government investigators)).

To estop the government, a regulated entity must show

that: (1) the government made a “definite representation”; (2)

on which the entity “relied . . . in such a manner as to change

[its] position for the worse”; (3) the entity’s reliance was

reasonable; and (4) “the government engaged in affirmative

misconduct.” Morris Commc’ns, Inc. v. FCC, 566 F.3d 184,

191 (D.C. Cir. 2009) (quoting Graham v. SEC, 222 F.3d 994,

1007 (D.C. Cir. 2000)). In this case, assuming that the

government made a “definite representation” to Masters that it

would identify problems with the SOMS within 220 days of an

inspection, see 80 Fed. Reg. at 55,425, Masters has

demonstrated neither reasonable reliance on the statement nor

affirmative government misconduct.

There is no evidence of reliance on Masters’ part. If

Masters had waited 220 days after the effective date of the

Settlement Agreement to ensure that DEA had no quarrels with

the SOMS, and then rigorously implemented the SOMS as a

compliance strategy, Masters might be able to claim that it

relied on DEA’s statement about “written notice.” But that is

not what happened. Instead, following the Compliance

29

Review—at which Masters presented and promised to follow

its brand-new SOMS—Masters’ employees consistently failed

to implement the SOMS Protocol. Consequently, Masters

cannot claim that it relied to its detriment on DEA’s review.

Even if Masters had shown that it actually relied on the

Administrator’s undertaking to provide written notice of any

problems with the SOMS, there are several reasons why it

would have been unreasonable to place great weight on such a

promise. At the time of the Compliance Review, the SOMS

was only three or four days old; consequently, Masters’

employees had no track record to show how they were

operating the SOMS in practice. The most DEA’s Diversion

Investigators were in a position to do is comment on the

adequacy of the SOMS Compliance Protocol on paper. Thus,

Masters could not reasonably believe that DEA’s failure to

provide written follow-up after the Compliance Review

amounted to approval of the way that Masters’ employees were

implementing—or failing to implement—the SOMS. In any

event, the Settlement Agreement expressly cautioned Masters

not to rely on the results of the Compliance Review, stating: “A

finding of ‘satisfactory’ [after the Review] does not otherwise

express DEA’s approval of Masters’ compliance program.”

J.A. 902.

And even if the DEA review addressed the SOMS in

operation, and even if Masters had reason to and did rely on

that review, there is no evidence suggesting that the

government engaged in the “affirmative misconduct”

necessary to sustain a claim of estoppel against the

government. Morris Commc’ns, Inc., 566 F.3d at 191. The bar

for establishing “affirmative misconduct” is high, requiring a

showing of “misrepresentation or concealment, or, at least,

behav[ior] . . . that . . . will cause an egregiously unfair result.”

GAO v. Gen. Accounting Office Pers. Appeals Bd., 698 F.2d

30

516, 526 (D.C. Cir. 1983). Generally, “ordinary negligence”

does not qualify as egregiously unfair conduct. See Bowman v.

D.C., 496 F. Supp. 2d 160, 164 (D.D.C. 2007). Nor does a

simple failure to perform under a contract. See Morris

Commc’ns, Inc., 566 F.3d at 191-92 (government did not

engage in “affirmative misconduct” when it promised to act on

a waiver request in 30 days, but failed to do so for three years).

Here, Masters has not identified any governmental misconduct,

let alone extraordinary misconduct.

V.

Masters further contends that the Administrator’s decision

violated the APA insofar as it was based on Masters’ refusal to

accept responsibility for its alleged misconduct. Masters

believes the Secretary decertified it for refusing to accept

responsibility “before the hearing and before DEA had

established its prima facie case.” Pet’r Br. 52. Such adverse

action would be inconsistent with DEA rules that guarantee

regulated parties an evidentiary hearing. 21 C.F.R. §§ 1301.41-

46 (DEA hearing regulations). Thus, Masters concludes, the

Administrator violated the provisions of the APA that require

agency decisions to be “in accordance with law” and to follow

the “procedure[s] required by law.” See 5 U.S.C. § 706 (2)(a),

(d).

Contrary to Masters’ suggestion, the Administrator did not

decertify Masters for putting DEA to its proof. As the

Administrator recently explained, DEA has “never held”—in

Masters’ case or any other—that “a respondent must admit to

[its] misconduct prior to even being able to test the

Government’s evidence at [a] hearing.” Hatem M. Ataya, M.D,

81 Fed. Reg. 8,221, 8,224 (Drug Enf’t Admin. Feb. 18, 2016).

Rather, under longstanding DEA precedent, once DEA

presents enough evidence at a hearing to show that a registered

31

vendor or distributor of controlled substances has “committed

acts inconsistent with the public interest,” the “registrant must

present[] . . . mitigating evidence” including evidence that it

has “accept[ed] responsibility for its actions and

demonstrate[d] that it will not engage in future misconduct.”

Medicine Shoppe—Jonesborough, 73 Fed. Reg. 364, 387

(Drug Enf’t Admin. Jan. 2, 2008) (internal quotation marks

omitted). In this case, the government came forward with

ample evidence that Masters committed acts inconsistent with

the public interest by failing to report suspicious orders.

Masters presented no responsive evidence showing that it had

recognized the consequences of its misconduct. In fact, before

trial, Masters went so far as to stipulate that it did “not accept

responsibility for any alleged wrongdoing.” J.A. 153.

Furthermore, Masters’ refusal to admit fault played only a

minor role in the Administrator’s decision to revoke Masters’

certificate. The Administrator emphasized that, because

Masters’ Compliance Protocol was “rarely, if ever followed,”

Masters failed to investigate “hundreds of suspicious orders”

for opioids. 80 Fed. Reg. at 55,501. That failure amounted to

an “extensive and egregious” violation of DEA regulations. Id.

The Administrator found that the “egregiousness” of the

violation was “exacerbated” by the fact that Masters’ officials

were “well aware of the oxycodone epidemic.” Id. Finally, the

Administrator noted “the Agency’s interest in deterring future

misconduct.” Id. In light of all those considerations, we

conclude that, regardless of whether Masters accepted

responsibility for its misconduct, the Administrator would have

revoked its certificate of registration. Given the evidence of

Masters’ failure to maintain effective controls against diversion

of controlled substances and the absence of mitigating evidence

of Masters’ acceptance of responsibility, the Administrator’s

decision to revoke Masters’ certificate of registration was

reasonable and supported by substantial evidence.

32

VI.

Finally, Masters contends that the Administrator violated

its due process rights by relying on arguments and evidence

that were not presented during the administrative trial. The

Due Process Clause gives regulated parties the right to fair

notice of the arguments and evidence against them. NLRB v.

Blake Constr. Co., 663 F.2d 272, 279 (D.C. Cir. 1981). An

agency may not rely on evidence or arguments that were not

discussed at a hearing as a basis for punishing a regulated party.

See id. Masters contends that the Administrator impermissibly

did just that: He relied on arguments DEA had forfeited and

evidence the ALJ had excluded as grounds to revoke Masters’

certificate of registration.

A.

In particular, Masters claims that the Administrator relied

on two points that DEA failed to preserve: (1) by April 1, 2009,

Masters had gathered information that the seven Florida-based

pharmacies listed in the 2013 OSC were potentially selling

opioids illegally; and (2) certain orders placed by those

pharmacies were suspicious because of their size, pattern, or

frequency, rather than the characteristics of the pharmacy

placing the order. Masters insists that those arguments were

not presented to the ALJ or the Administrator, depriving

Masters of any opportunity to refute them. Once again,

Masters’ argument is belied by the record.

Contrary to Masters’ suggestion, DEA never forfeited the

argument that, by April 1, 2009, Masters was on notice that the

seven pharmacies might be selling opioids illicitly. DEA

argued pretrial that “pre-April, 2009 evidence [would] be

offered [at trial] to show that Masters had knowledge of

potential problems with certain customers.” Order Granting in

Part Respondent’s Motion in Limine to Preclude Admission of

33

Irrelevant, Immaterial, and/or Incompetent Evidence and to

Adopt Findings at 5, Masters Pharm., Inc., No. 13-39 (Feb. 7,

2014), J.A. 161. The ALJ then ruled that DEA could use pre-

April, 2009, evidence. Following that ruling, Masters admitted

in evidence its 2008 business records. DEA witness James

Rafalski then testified that, given the information in Masters’

2008 records, Masters should have known that the Seven

Pharmacies engaged in patterns of conduct suggesting that they

might be involved in illicit opioid sales, including: telling

Masters that it was dispensing a relatively low quantity of

controlled substances during periods when utilization reports

showed that it was in fact dispensing suspiciously high

quantities of controlled substances; conducting a high

percentage of its controlled substance sales with cash; and

selling an unusually high ratio of controlled to non-controlled

medications. For example, Diversion Investigator Rafalski

provided written testimony that, in light of Masters’ 2008

records for Englewood, Masters should have been cautious

about any of Englewood’s orders for controlled substances.

See J.A. 1151-54. As noted above, those records contain a

report from a Masters investigator noting that Englewood’s

pharmacist seemed to be lying about his controlled substance

sales. Id. at 1153. In addition, Englewood’s utilization report

dated September 22, 2008, “revealed that approximately 80%

of all pharmaceuticals [it] dispensed were controlled

substances.” Id. at 1154. According to Rafalski, Masters’ 2008

files for other customers raised similar concerns, yet Masters

paid no special attention to those customers’ orders for

controlled medications. Thus, in its proposed findings of fact

and conclusions of law, DEA argued that Masters’ customer

files—which included the 2008 records—“revealed numerous

red flags . . . that were regularly ignored.” Id. at 297. On this

record, Masters cannot credibly claim that DEA forfeited its

arguments based on pre-April 2009 evidence, or that it lacked

fair notice that DEA would rely on that evidence. Cf. Katz v.

34

SEC, 647 F.3d 1156, 1161-62 (D.C. Cir. 2011) (regulated party

had fair notice that the SEC would rely on “false account

statements,” where an administrative hearing officer denied a

motion to strike those statements and the statements were later

introduced at the administrative trial).

Masters makes a similarly unsupported assertion that

“DEA never identified in its [2013 Order to Show Cause],

prehearing statements, or written or oral testimony[,] a single

order for controlled substances . . . that DEA deemed

suspicious due to its unusual size, its deviation from a usual

pattern, or its unusual frequency.” Pet’r Br. 31. “Likewise,”

Masters protests, “DEA never alleged that every order held for

review by [the Computer Program] was per se suspicious . . .

unless Masters obtained and independently verified the reason

for the order.” Id. Masters accordingly objects to the

Administrator’s reliance on Masters’ inadequate response to

held orders.

We are somewhat mystified by this argument. Before the

administrative trial began, DEA provided Masters a copy of the

written testimony of DEA Diversion Investigator Rafalski. In

that testimony, Rafalski stated that, in his conversations with

Masters’ staff, he learned that the SOMS computer program

was designed to hold orders of an unusual size, pattern, or

frequency. J.A. 1124. That testimony was confirmed by

Masters’ policy manual, which states that the SOMS Computer

Program was designed to hold “all orders for controlled drugs

that meet or exceed the criteria set out in 21 C.F.R. [§]

1301.74(b),” i.e., orders of unusual size, pattern, or frequency.

Id. at 1436. Echoing that evidence, DEA’s proposed findings

of fact and conclusions of law: (a) noted that the Computer

Program held orders of an unusual “size, pattern, or

frequency”; and (b) asserted that Masters’ failure to follow its

own policies—including the policy requiring Masters to

35

“discern the reason for [an order’s] deviation in size, pattern,

or frequency”—rendered Masters’ system for complying with

DEA regulations ineffective. Id. at 296. Thus, Masters had

ample opportunity to consider and rebut the proposition that

orders held by the Computer System were orders of a

suspicious size, pattern, or frequency, which Masters had a

legal obligation to report or investigate.

B.

1.

Masters also insists that the Administrator violated its due

process rights by relying on excluded evidence. Specifically,

Masters claims that the ALJ ordered the exclusion of

“information Masters gathered” before April 1, 2009, but that

the Administrator nonetheless relied on the excluded

information in determining that Masters should have

questioned orders placed by the Seven Pharmacies. Pet’r Br.

at 27-29. Masters points to the Administrator’s reliance on

information that Masters gathered in December 2008 to support

his conclusion that Masters should have been suspicious of

later orders placed by Tru-Valu, and similar reliance on

information Masters gathered “prior to April 1, 2009” to

support his conclusion that Masters should have suspected The

Drug Shoppe, Englewood, City View, Superior, and

Morrison’s. Id.

The ALJ’s ruling specifically permitted DEA to rely on

pre-April 1, 2009, information to “show that Masters had

knowledge of potential problems with certain customers” that

should have informed its later interactions with those

customers; Masters’ contrary contention fails to acknowledge

the role the ALJ reserved for evidence of Masters’ earlier

exposure to certain pharmacies. J.A. 161. What the ALJ ruled

off-limits was any administrative liability on Masters’ part for

36

alleged violations of DEA regulations before April 1, 2009.

But the ALJ held that the Administrator could—and he did—

introduce evidence of Masters’ long-held knowledge that

certain pharmacies had been operating in ways strongly

suggesting that they were diverting controlled substances,

including its knowledge of operations reaching back before

April 2009. Evidence of Masters’ pre-April 2009 experiences

highlighted that Masters should have been particularly diligent

in reviewing orders placed by certain known, rogue

pharmacies. That evidence permissibly bolstered the

Administrator’s conclusions that, when Masters failed to

investigate and report suspicious orders those same pharmacies

placed after August 18, 2009, it violated the regulations. That

use of pre-April 1, 2009, information was expressly permitted

by the ALJ’s pretrial order.

2.

Masters further contends that the Administrator violated

its due process rights by relying on evidence that the ALJ

excluded regarding Masters’ misconduct between April 1,

2009, and August 18, 2009. That was the post-settlement

period when Masters was setting up its new compliance

program and DEA was evaluating the program. The

Administrator determined that the ALJ should not have

excluded that evidence; as he explained, “[n]othing in the

[Settlement Agreement] provided [Masters] with immunity for

potential violations [of the Controlled Substances Act] during

[that time].” See 80 Fed. Reg. at 55,429 n.22. Consequently,

the Administrator’s decision repeatedly refers to Masters’

failure to report suspicious orders of controlled substances

between April and August of 2009.

On this point, we conclude that Masters’ claim of error is

well founded. Even though the Administrator permissibly held

37

that the ALJ’s evidentiary ruling was wrong, the Administrator

could not proceed to rely on the excluded evidence of Masters’

misconduct during the post-settlement review period. Doing

so would be in derogation of Masters’ right to respond to it.

Because the ALJ had excluded the evidence, however, Masters

had no need or opportunity during the administrative trial to

exercise its right to respond.

The Administrator’s error did not, however, rise to the

level of a due process violation. Crucially, the Administrator

recognized that reliance on that transition-period evidence

might be impermissible. Id. at 55,501 n.198. He was thus

careful to note that any discussion of that evidence was dicta:

Even setting the disputed evidence aside, the Administrator

explained, “the scope of [Masters’] failure to report suspicious

orders following the [C]ompliance [R]eview [was] so

extensive and egregious that I would come to the same

conclusion that the revocation of [Masters’] registration is

warranted to protect the public interest.” Id. Because the

Administrator did not base his holding on the excluded

evidence, Masters was not unlawfully deprived of its right to

contest it. Cf. SEC v. Whittemore, 659 F.3d 1, 13 (D.C. Cir.

2011) (erroneous admission of evidence did not violate

“substantial rights” where the evidence “was not

determinative” of the outcome).

3.

Masters contends that the Administrator also erred in

considering other excluded evidence. As is relevant here, the

ALJ’s pretrial order instructed the government not to rely on

paragraphs 6 and 24 of DEA Diversion Investigator Kyle

Wright’s declaration. Nevertheless, Masters asserts, the

Administrator cited those paragraphs in his decision. Even if

the Administrator erroneously cited the excluded paragraphs

38

from Investigator Wright’s testimony, both of those paragraphs

address Masters’ alleged misconduct before August 2009. See

J.A. 163. As discussed above, the Administrator’s decision

was fully supported by evidence of Masters’ failure to report

suspicious orders after that date. See 80 Fed. Reg. at 55,501

n.198. Thus, for the reasons stated in the previous section, the

Administrator’s mention of the excluded portions of

Investigator Wright’s testimony was consistent with Masters’

due process rights.

***

Because Masters has not identified any prejudicial errors

in the Administrator’s decision, we deny Masters’ petition for

review.