Masters Pharmaceutical, Inc. v. Drug Enforcement Administration

United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT

Argued January 12, 2017 Decided June 30, 2017

No. 15-1335

MASTERS PHARMACEUTICAL, INC.,
PETITIONER

v.

DRUG ENFORCEMENT ADMINISTRATION,
RESPONDENT

On Petition for Review of a Final Order
of the Drug Enforcement Administration

Richard T. Lauer argued the cause for petitioner. With
him on the briefs were John A. Gilbert Jr., Karla L. Palmer,
and Andrew J. Hull.

Nicolas Riley, Attorney, U.S. Department of Justice,
argued the cause for respondent. With him on the brief were
Benjamin C. Mizer, Principal Deputy Assistant Attorney
General, and Mark B. Stern, Attorney. Anita J. Gay and Lena
D. Watkins, Attorneys, entered appearances.

Gregory G. Garre, Philip J. Perry, Andrew D. Prins,
Alexandra Shechtel, Richard L. Frank, David L. Durkin, and
Donald L. Bell II were on the brief for amici curiae Healthcare
Distribution Management Association and National
Association of Chain Drug Stores in support of neither party.
 2

Larry P. Cote was on the brief for amicus curiae Generic
Pharmaceutical Association in support of neither party and in
support of neither affirmance nor reversal.

Before: SRINIVASAN and PILLARD, Circuit Judges, and
EDWARDS, Senior Circuit Judge.

Opinion for the Court filed by Circuit Judge PILLARD.

PILLARD, Circuit Judge: Breakthroughs in the
development of prescription opioid painkillers have vastly
increased their popularity. But that popularity has taken a toll.
Opioids are heavily addictive and often lethal in high doses.
The Drug Enforcement Administration (DEA or agency) has
therefore listed opioids such as hydrocodone and oxycodone as
controlled substances so that DEA can monitor and restrict
their sale. Over the past two decades, DEA has been battling a
steep increase in prescription opioid abuse—a problem that
DEA views as an “epidemic.” U.S. Dep’t of Justice, Drug Enf’t
Admin., Order to Show Cause (Aug. 9, 2013), J.A. 8-9. The
Department of Health and Human Services (HHS), too, sees
the rising abuse of prescription opioids as “a serious and
challenging” public health issue. DEP’T OF HEALTH & HUMAN
SERVS., OPIOID ABUSE IN THE U.S. AND HHS ACTIONS TO
ADDRESS OPIOID-DRUG RELATED OVERDOSES AND DEATHS
(2015). Since 1999, the number of deaths from prescription
painkillers in the United States has more than quadrupled.
CENTERS FOR DISEASE CONTROL AND PREVENTION, Opioid
Overdose: Understanding the Epidemic,
https://www.cdc.gov/drugoverdose/epidemic/index.html (last
visited June 12, 2017). Prescription opioids now kill an
average of 44 Americans per day. U.S. DEP’T OF HEALTH &
HUMAN SERVS., About the Epidemic,
 3
https://www.hhs.gov/opioids/about-the-epidemic (last visited
June 12, 2017).

Masters Pharmaceuticals, Inc., (Masters) supplies
prescription medications in bulk to pharmacies across the
United States. Before this litigation began, Masters was
registered with DEA as a vendor of controlled substances,
including opioids. As a registrant, Masters had an obligation
to report to DEA suspicious orders for controlled substances
and to take other precautions to ensure that those medications
would not be diverted into illegal channels.

This case challenges DEA’s 2014 decision to revoke
Masters’ certificate of registration, without which Masters
cannot sell controlled substances. The revocation order turned
on DEA’s conclusion that Masters had shirked its legal
obligation to report suspicious orders for controlled substances.
Masters challenges the factual basis of DEA’s revocation
decision, and claims it exceeded DEA’s authority under its
existing regulations, effectively broadening them in a manner
that was inconsistent with the Administrative Procedure Act
(APA). In addition, Masters suggests, DEA improperly relied
on arguments and evidence that were not presented during the
administrative trial, in violation of the Due Process Clause.
Because we see no prejudicial error in DEA’s decision, we
deny Masters’ petition for review.

I.

A.

The Controlled Substances Act authorizes commercial
distribution of certain controlled substances for therapeutic use,
but requires all distributors to register with DEA. See 21
U.S.C. § 823(b), (e); 28 C.F.R. § 0.100. The Administrator of
DEA (the Administrator) closely observes registered
 4
distributors to ensure that their operations are “[]consistent
with the public interest.” 21 U.S.C. § 824(a)(4); see also 28
C.F.R. § 0.100; 21 C.F.R. § 1301.71. In evaluating a
distributor’s operations, the Administrator considers: (1)
whether the distributor has maintained “effective control[s]
against diversion of particular controlled substances into other
than legitimate medical, scientific, and industrial channels”; (2)
whether the distributor has complied with applicable state and
local laws; (3) whether the distributor has previously been
convicted under federal or state laws for a crime related to the
sale of controlled substances; (4) the distributor’s past
experience with controlled substances; and (5) “such other
factors as may be relevant to and consistent with the public
health and safety.” 21 U.S.C. § 823(b), (e). The Administrator
is “not required to make findings as to all of the[se] factors,”
and “may give each factor the weight he deems appropriate.”
Morall v. DEA, 412 F.3d 165, 173-74 (D.C. Cir. 2005) (internal
quotation marks omitted). If the distributor’s operations fail to
live up to the public-interest standard, the Administrator may
“suspend[] or revoke[]” the distributor’s certificate. 21 U.S.C.
§ 824(a)(4).

Where, as here, the Administrator considers the first
factor—the maintenance of “effective controls” against the
“diversion” of controlled substances—the Administrator must
determine whether the registrant complied with DEA’s
“security requirements.” 21 C.F.R. § 1301.71(a). The
“security requirement” at the heart of this case mandates that
distributors “design and operate a system” to identify
“suspicious orders of controlled substances” and report those
orders to DEA (the Reporting Requirement). 21 C.F.R.
§ 1301.74(b). The Reporting Requirement is a relatively
modest one: It requires only that a distributor provide basic
information about certain orders to DEA, so that DEA
“investigators in the field” can aggregate reports from every
 5
point along the legally regulated supply chain and use the
information to ferret out “potential illegal activity.”
Southwood Pharm., Inc., 72 Fed. Reg. 36,487, 36,501 (Drug
Enf’t Admin. July 3, 2007). Once a distributor has reported a
suspicious order, it must make one of two choices: decline to
ship the order, or conduct some “due diligence” and—if it is
able to determine that the order is not likely to be diverted into
illegal channels—ship the order (the Shipping Requirement).
See id. at 36,500.

B.

On October 17, 2008, a DEA Deputy Assistant
Administrator issued an order to show cause why DEA should
not revoke Masters’ certificate of registration (the 2008 Order
to Show Cause, or 2008 Order). U.S. Dep’t of Justice, Drug
Enf’t Admin., Order to Show Cause (Oct. 17, 2008). That
Order alleged that Masters had “failed to maintain effective
controls against diversion” of hydrocodone, a powerful opioid.
Id.; see also Masters Pharm., Inc., 80 Fed. Reg. 55,418, 55,421
(Drug Enf’t Admin. Sept. 15, 2015). “Throughout 2007 and
2008,” Masters violated the Reporting Requirement by failing
to notify DEA when “rogue Internet pharmacies” placed
suspicious hydrocodone orders. 80 Fed. Reg. at 55,421-22. In
addition, Masters allegedly filled those hydrocodone orders
without performing adequate due diligence, in violation of the
Shipping Requirement. See 80 Fed. Reg. at 55,421-22.

On April 1, 2009, DEA and Masters agreed to settle the
charges in the 2008 Order. The settlement agreement required
Masters to pay $500,000 to the agency and bring the company
into compliance with DEA regulations by implementing a
compliance system “to detect suspicious orders” for controlled
substances and “prevent diversion of controlled substances”
into illegal channels. Settlement and Release Agreement and
 6
Administrative Memorandum of Agreement at 2 (Apr. 1,
2009), J.A. 899. Masters further promised that orders
“identified as suspicious” by the compliance system would “be
reported to . . . DEA.” Id.

To fulfill its obligations under the settlement agreement,
Masters created a compliance system called the “Suspicious
Order Monitoring System” or “SOMS,” consisting of a
computer program (the Computer Program) and a protocol for
Masters’ employees (the Compliance Protocol, or Protocol).
The Computer Program was designed to identify any order for
controlled substances that “me[t] or exceed[ed]” the criteria for
suspicious orders set out in 21 C.F.R. § 1301.74(b). J.A. 1436.
In other words, the computer program was designed to identify
orders of an unusual “size,” “frequency,” or “pattern.” 21
C.F.R. § 1301.74(b). Thus, for each of the controlled
medications that Masters sold, the Computer Program tracked
the number of doses that Masters’ customers ordered over the
preceding six calendar months. Each customer’s highest
monthly total would then be treated as the customer’s
“Controlled Substance Limit.” 80 Fed. Reg. at 55,423 n.12;
see also J.A. 1395-96. If a customer ordered enough doses in
any 30-day period to exceed its Controlled Substance Limit,
the Computer Program would hold the customer’s most recent
order for the medication so it could be reviewed by Masters’
staff. The Computer Program also held the most recent order
placed by a customer if the customer submitted more order
forms in a 30-day period than it had in any of the prior six
calendar months, or if the timing of the order did not comport
with the customer’s general ordering pattern over those six
months. J.A. 1397.

Once an order was held, Masters’ staff would implement
the SOMS Protocol, which required Masters’ staff to take
specified steps to investigate the order and determine whether
 7
it was legitimate. The SOMS Protocol required Masters’ staff
to initiate the investigation by “call[ing] the customer” that
placed the held order, “request[ing] . . . [a]n explanation,”
documenting the customer’s response, and then “independently
verify[ing]” the information that the customer provided.
J.A. 1213, 1436. In addition, Masters’ staff was required to
obtain a “current utilization report” from the ordering
pharmacy—i.e., a list all of the controlled and non-controlled
medications that the pharmacy dispensed in the most recent
calendar month. Id. at 1436. Masters’ employees would then
“examine[]” the pharmacy’s “entire file,” including its order
history, survey responses, and records of any “site visit[s]”—
i.e., occasions on which Masters’ staff physically observed
customers’ premises for signs that they participated in the black
market, id. at 1436, 1441, such as a long line of customers
awaiting prescriptions at an odd time of day, 80 Fed. Reg. at
55,484, or multiple cars in the pharmacy parking lot with out-
of-state license plates, id. at 55,490. If the customer provided
all of the information that Masters’ staff requested, and Masters
determined that: (a) the held order was “consistent with the
customer’s utilization report”; and (b) the “customer’s entire
file, including survey responses and site visits, [was] consistent
with legitimate business practices,” Masters’ staff could deem
the order non-suspicious and ship it. J.A. 1436. Otherwise,
Masters would treat the order as “suspicious,” report it to DEA
as required by 21 CFR 1301.74(b), and decline to fill it.

In the four years after Masters signed the Settlement
Agreement, DEA grew concerned that Masters’ staff was
failing to detect and report to DEA suspicious orders of
oxycodone products, in violation of 21 C.F.R. 1301.74(b). On
August 9, 2013, a Deputy Assistant Administrator of DEA
issued a second order to show cause why Masters’ certificate
of registration should not be revoked (the 2013 Order to Show
Cause, or 2013 Order), alleging that “Masters consistently
 8
ignored and/or failed to implement” its controlled substance
policies and failed to comply with the Reporting Requirement.
U.S. Dep’t of Justice, Drug Enf’t Admin., Order to Show Cause
(Aug. 9, 2013), J.A. 10. The 2013 Order further alleged that
Masters violated the Shipping Requirement by filling orders for
millions of dosage units of oxycodone for eight illegitimate
pharmacies in Florida and Nevada: Tru-Valu Drugs; The Drug
Shoppe; Medical Plaza Pharmacy; Englewood Specialty
Pharmacy; City View Pharmacy; Lam’s Pharmacy; Morrison’s
RX; and Temple Terrace Pharmacy, doing business as Superior
Pharmacy.

Administrative Law Judge Gail Randall (the ALJ) tried the
noncompliance allegations. She first concluded that Masters
had substantially complied with the Reporting Requirement.
From her perspective, Masters had a duty to report an order
held by the Computer Program only if Masters’ staff
determined that the pharmacy placing the order was “likely
diverting controlled substances.” Recommended Findings of
Fact, Conclusions of Law, and Decision of ALJ, Masters
Pharm., Inc., No. 13-39, at 156 (June 19, 2014) (ALJ
Decision). She thought Masters had shirked that duty on only
one occasion, and that failure to report a single suspicious order
did not warrant revocation of Masters’ certificate of
registration. Id. at 201.

For similar reasons, the ALJ also concluded that Masters
had substantially complied with the Shipping Requirement.
The ALJ held that, under the Shipping Requirement, a
pharmaceutical distributor like Masters could ship an order for
controlled substances if it conducted enough due diligence to
guard against any likelihood that the order would be diverted
into unlawful channels. ALJ Decision at 201 (quoting
Southwood, 72 Fed. Reg. at 36,502). And Masters’
 9
investigation into orders held by the Computer Program was,
in her view, sufficient to satisfy that standard.

In an eighty-three page Decision and Order published in
the Federal Register, the Acting Administrator rejected the first
part of the ALJ’s recommendation, and concluded that Masters
had repeatedly violated the Reporting Requirement. The
Administrator explained that the ALJ’s suspicious-order
analysis was legally flawed because it misapprehended the
“standard for reporting an order as suspicious.” 80 Fed. Reg.
at 55,478. The ALJ insisted that an order was suspicious only
if Masters had found it “likely” that the order would be diverted
away from legitimate medical or scientific channels, but the
amount of evidence needed to raise a “suspicion” is “far lower”
than the amount of evidence needed to show that something is
“likely.” Id. A suspicion is merely “[t]he apprehension or
imagination of the existence of something wrong based . . . on
inconclusive or slight evidence.” Id. (quoting Black’s Law
Dictionary 1,585 (9th ed. 2009)). With that definition in mind,
the Administrator reviewed Masters’ SOMS manual and
determined that any order held by the Computer Program was
held due to its unusual size, frequency, or pattern, and DEA
regulations expressly provide that deviations in size,
frequency, or pattern are the sort of indicia that give rise to a
suspicion and, unless the suspicion is dispelled, the obligation
to report. See id. at 55,479; 21 C.F.R. § 1301.74(b).

The record evidence showed that, on hundreds of
occasions, Masters neither reported orders held by the SOMS
Computer Program nor implemented the SOMS Protocol to
dispel the suspicion surrounding held orders. For example, on
numerous occasions, rather than conducting the investigation
contemplated by the Protocol, Masters’ employees deleted held
orders or reduced their size so that they would no longer trigger
the hold. At other times, Masters’ employees did contact their
 10
customers to obtain explanations for held orders, but simply
accepted whatever the pharmacies told them, without taking (or
documenting) requisite steps to determine whether the
explanations were accurate or even plausible. Perhaps most
problematically, when customers provided information that
confirmed the suspicion surrounding orders held by the SOMS,
Masters still failed to report the orders to DEA. The
Administrator ultimately concluded that Masters’ frequent
violations of the Reporting Requirement warranted revocation
of Masters’ certificate of registration; he therefore had no need
to consider whether Masters additionally violated the Shipping
Requirement.

II.

Masters claims that the Administrator’s key factual
findings are unsupported by the record. As Masters
acknowledges, we must accept the Administrator’s findings so
long as they are supported by “substantial evidence.” 21
U.S.C. § 877. The substantial evidence test is “[h]ighly
deferential to the factfinder,” New Valley Corp. v. Gilliam, 192
F.3d 150, 154 (D.C. Cir. 1999), requiring only such evidence
that a “reasonable mind might accept as adequate to support a
conclusion,” S.C. Pub. Serv. Auth. v. FERC, 762 F.3d 41, 54
(D.C. Cir. 2014) (quoting Murray Energy Corp. v. FERC, 629
F.3d 231, 235 (D.C. Cir. 2011)). We cannot reverse the
Administrator’s factual findings even if, had we been in his
position, we “would have weighed the evidence differently.”
Cumberland Coal Res., LP v. Fed. Mine Safety & Health
Review Comm’n, 717 F.3d 1020, 1028 (D.C. Cir. 2013).

Accepting that we view the Administrator’s factfinding
deferentially, Masters still sees insufficient evidence to support
some of his factual conclusions. Masters contends that the
record contains inadequate evidence to support the
 11
Administrator’s conclusions that: (1) whenever an order for
controlled substances was held by the SOMS Computer
Program, that order was presumptively “suspicious” under 21
C.F.R. § 1301.74(b); and (2) Masters’ employees rarely
undertook the investigation required to dispel the suspicion
surrounding held orders. After full consideration of the parties’
briefs and arguments, and examination of the record and the
careful and detailed decisions of the ALJ and the
Administrator, we believe the Administrator’s conclusions are
well founded.

A.

Masters first challenges the Administrator’s conclusion
that any held order was suspicious under 21 C.F.R.
§ 1301.74(b)—at least unless Masters dispelled the suspicion
through investigation. That conclusion, Masters insists, is
inconsistent with the language of Masters’ Comprehensive
Compliance Policy Manual, which provides that the Computer
Program will flag all orders that have even the potential to be
suspicious. According to Masters, the Manual contemplates
that the Computer Program will “hold[] every order that is
suspicious as defined in 21 C.F.R. § 1301.74(b),” as well as
“many orders that are not suspicious.” Pet’r Br. 33. As a result,
Masters insists, an order will “only be deemed” suspicious
under Masters’ policies if it is held by the Computer Program
and a Masters employee follows up and separately makes a
determination that it is suspicious. Pet’r Br. 34-35.

As an initial matter, Masters offers a strained reading of its
Comprehensive Compliance Policy and Manual. The manual
expressly states that the Computer Program “[h]olds all orders
for controlled drugs that meet or exceed the [suspicious order]
criteria set out in 21 C.F.R. § 1301.74(b)”—rather than orders
that potentially meet or exceed those criteria. J.A. 1436. In
 12
other words, the Computer Program was designed to hold
orders that are suspicious within the meaning of the regulation,
even as it gave Masters’ employees the opportunity—through
the due-diligence investigation contemplated by the
Compliance Protocol—to dispel the suspicion surrounding
held orders.

More fundamentally, the key question in this case is not
whether held orders qualified as “suspicious” under Masters’
policies; the question is whether they qualified as “suspicious”
under 21 C.F.R. § 1301.74(b). Thus, while Masters frames its
challenge on this point in substantial-evidence terms, the
relevant inquiry is more legal than factual: It asks how far the
language of the regulation reaches. Undertaking that legal
exercise, the Administrator reasonably determined that all held
orders were “suspicious” within the meaning of the regulation.
Section 1301.74(b) provides that “[s]uspicious orders include
orders of unusual size, orders deviating substantially from a
normal pattern, and orders of unusual frequency.” Apparently
tracking that regulatory language, the Computer Program held
an order if: (a) that order—combined with other orders placed
in the same 30-day period—requested more doses of a
controlled medication than the pharmacy had requested in any
of the previous six calendar months; (b) the pharmacy ordered
a controlled medication more frequently in a 30-day period
than it had in any of the previous six calendar months; or (c)
the pharmacy’s ordering pattern for a controlled medication
deviated in some other notable way from its ordering pattern
over the previous six months. As a matter of common sense
and ordinary language, orders that deviate from a six-month
trend are an “unusual” and not “normal” occurrence. It was
therefore entirely reasonable for the Administrator to hold that
orders held by the Computer Program met the regulatory
definition of “suspicious orders” unless Masters’ staff dispelled
the suspicion. 80 Fed. Reg. at 55,479 n.164; see Auer v.
 13
Robbins, 519 U.S. 452, 461 (1997) (explaining that courts must
defer to an agency’s reasonable interpretations of its own
regulations).

Finally, Masters contends that it is impossible to identify
whether a held order is suspicious within the meaning of DEA
regulations until a Masters employee has completed the SOMS
Protocol. But if we were to credit Masters’ assertion that “the
SOMS . . . holds many orders that are not suspicious,” Pet’r Br.
33, it would be even clearer that Masters failed to “operate” a
“system” for sorting suspicious from non-suspicious orders, in
violation of 21 C.F.R. § 1301.74(b). By taking the position that
orders initially held by the SOMS Computer Program are not
thereby identified as suspicious, Masters’ case that it complied
rests entirely on whether the company carried out some other
process that would identify suspicious orders. The process
Masters contends it used to do that is the SOMS Protocol.
Under that theory, an order can only be suspicious once an
employee has run the SOMS Protocol from beginning to end.
But, as the next section describes, the record contains
overwhelming evidence that Masters’ employees routinely
failed to implement the SOMS Protocol.

B.

Masters also contends that there is insufficient evidence to
support the Administrator’s finding that Masters repeatedly
failed to report orders held as suspicious, or to conduct the sort
of investigation that could dispel the suspicion that such orders
were at risk of diversion. We conclude that, to the contrary, the
Administrator’s decision contains ample support for his
specific findings of Masters’ failures, in violation of the
regulations, to report suspicious orders.

More particularly, as noted above, when the Computer
Program held an order, Masters’ written Compliance Protocol
 14
required that a Masters employee call the pharmacy that placed
the order, request an explanation and a current utilization
report, and conduct an investigation to independently verify the
pharmacy’s information and explanation. J.A. 1436.
According to the written testimony of Wayne Corona, a full-
time consultant for Masters who helped develop the SOMS, the
Compliance Protocol required the investigating employee to
document the results of his or her inquiry “in the due diligence
file[]” for the pharmacy that placed the order, “specifically in
the Memos for Record (‘MFR’).” J.A. 1213. Indeed, Corona
emphasized that “documentation was the linchpin of th[e]
whole system.” 80 Fed. Reg. at 55,427 n.19. In light of the
essential documentation requirements, the Administrator
scoured Masters’ files on the Florida-based pharmacies listed
in the 2013 Order to Show Cause in an effort to discern what
Masters’ staff had done to verify that held orders were not
suspicious and so need not be reported.

Those files are replete with evidence that Masters
routinely failed to investigate held orders. Most strikingly, in
lieu of reporting all held orders, Masters’ employees deleted
some and edited others so that they appeared to be of a normal
size and pattern, and then proceeded to fill them. While
deleting or editing orders may have limited the amount of
oxycodone flowing to Masters’ customers, that practice
subverted the Reporting Requirement. The law requires
registered suppliers like Masters to alert DEA when their retail-
pharmacy customers attempt to obtain unusual amounts of a
controlled substance, because such attempts are powerful
evidence that the pharmacies are operating illegally.

In other instances, Masters’ employees simply released
orders from hold and filled them as written, again without
reporting them to DEA or investigating to see whether they
might dispel the suspicion that caused the order to be placed on
 15
hold. For many of those orders, Masters had no record that any
employee even took the initial investigative step of calling the
ordering pharmacy. Records were absent despite Masters’
representation to DEA that “[d]ocumentation on all orders held
for review and their disposition are permanently retained.” 80
Fed. Reg. at 55,428. As the Administrator noted, the lack of
documentation was evidence that the phone calls never took
place: “The absence of an entry [in business records], where
an entry would naturally have been made if a transaction had
occurred, should ordinarily be equivalent to an assertion that
no such transaction occurred, and therefore should be
admissible in evidence for that purpose.’’ Id. (quoting 5
Wigmore, Evidence § 1531, at 463 (Chadbourn rev. 1974)
(emphasis added)).

Even when Masters’ employees took some steps to probe
the reasons orders were held, their efforts were too tentative,
pro forma, and incomplete to dispel suspicion, yet Masters
failed to report the orders to DEA. Many of Masters’ files
contain entries suggesting that a Masters employee called a
pharmacy to request an explanation for a held order, but either
failed to obtain any explanation or, if it got one, to make
corresponding entries showing that the employee verified that
explanation. In Masters’ file for City View pharmacy, for
example, there are notes documenting Masters’ repeated calls
to the pharmacy, see 80 Fed. Reg. at at 55,494, and notes
documenting City View’s assertion that it needed large
amounts of oxycodone because it was “servicing two small
nursing homes and was near a medical center.” Id. at 55,493.
But there is no record that a Masters employee “even obtain[ed]
the names of the homes, let alone inquire[d] as to how many
residents they had.” Id. Similarly, Masters determined that
Superior Pharmacy had justified its request for large amounts
of oxycodone because “Superior was filling prescriptions for a
juvenile in-patient facility. However, [Masters] obtained no
 16
information as to the type of treatment being provided by the
facility, the number of patients it had, and whether its patients
would even be treated with drugs such as oxycodone 30.” Id.
at 55,499 (internal quotation marks omitted). In the same vein,
Masters accepted Medical Plaza’s claim that it was ordering
large amounts of oxycodone in part because it was “[i]n a
medical building of 60 doctors,” without conducting any
“inquiry into the practice specialties of these physicians and
whether they would be prescribing such powerful narcotics as
oxycodone 30 in the course of their medical practices.” Id. at
55,458, 55,495 (internal quotation marks and brackets
omitted).

What limited investigative records Masters maintained
also show that Masters’ employees rarely got customers’ recent
utilization reports to place held orders in context. Without
those reports (or some comparable information), Masters could
not know what proportion of a pharmacy’s prescription
business was controlled substances. It therefore could not
confirm that the pharmacy’s dispensing practices were
consistent with those of a legitimate business.

Further, Masters’ records show that investigations into
held orders often ended with an employee recording a
demonstrably false explanation for the order, or with the
employee’s harboring unresolved doubts about the order’s
validity, yet failing to share those doubts with DEA. For
instance, Masters’ employees often concluded that an order for
controlled substances was justified because it was consistent
with the pharmacy’s utilization report, even where there was
no current utilization report on file or when the utilization
report showed “highly suspicious” dispensing patterns. See,
e.g., id. at 55,486, 55,500. In other cases, Masters’ employees
said that orders were justified because they were within the
Controlled Substance Limit established by the SOMS
 17
computer program, despite the fact that the orders had been
held because they violated that limit. See id. at 55,500.

Finally, Masters’ employees frequently ended their
investigations by noting that they were filling controlled
substance orders “with reservation.” See, e.g., 80 Fed. Reg. at
55,427, 55,432-33, 55,437-38, 55,448, 55,459. Such
“reservation[s]” suggest that Masters’ employees were
dissatisfied with the explanations they received for particular
controlled substance orders. Yet they repeatedly failed to
report those orders to DEA. See id.

Masters urges us to disregard the overwhelming evidence
that it failed to conduct meaningful investigations into held
orders, pointing to some contrary evidence in the record. In
particular, Jennifer Seiple, Masters’ chief compliance officer,
testified that Masters investigated all orders held by the
Computer Program (even orders it edited or deleted). But the
Administrator carefully considered evidence that Masters cited
in its favor, including Ms. Seiple’s testimony, and found that
the evidence was either implausible or unresponsive to the
government’s evidence. See, e.g., 80 Fed. Reg. at 55,420 n.5,
55,471 n.152, 55,483 n.174.

In sum, the Administrator painstakingly explained the
factual bases for his conclusions. He found that, when SOMS
held an order, Masters routinely neither reported to DEA nor
took even a single investigative step. Faced with orders that
were suspicious for the core reasons in the regulation—unusual
size, pattern, or frequency—Masters’ employees frequently
simply brushed suspicion under the rug by deleting orders or
paring them down and shipping them without reporting them
to DEA. They also, time and again, simultaneously
acknowledged their own concerns while behaving in ways that
ensured those concerns would not be addressed: They filled
 18
suspicious orders with expressed “reservations,” without
notifying DEA. On occasions when Masters took a stab at
investigating in response to a SOMS hold, it accepted, without
seeking to verify, the half-baked or implausible explanations
its customers supplied. We have considered each of Masters’
challenges to the sufficiency of the evidence. Our review gives
us no ground to disturb the Administrator’s carefully
documented conclusions. See Cumberland Coal Res., LP, 717
F.3d at 1028.

III.

Masters further contends that the Administrator’s decision
effectively amended existing DEA rules in violation of the
APA. When an agency creates rules on a blank slate, it
generally has the option of choosing whether to establish new
policies through notice-and-comment rulemaking or
adjudication. See, e.g., POM Wonderful, LLC v. FTC, 777 F.3d
478, 497 (D.C. Cir. 2015) (“[T]he choice between rulemaking
and adjudication lies in the first instance within the agency’s
discretion.” (quoting Cassell v. FCC, 154 F.3d 478, 486 (D.C.
Cir. 1988))). But Masters contends that, once an agency
promulgates a rule following public notice and comment, it
may not amend or repeal the rule in an administrative
adjudication. See Pet’r Br. 49 (citing Marseilles Land & Water
Co. v. FERC, 345 F.3d 916, 920 (D.C. Cir. 2003)). In Masters’
view, the Administrator amended two notice-and-comment
rules in adjudicating this case: 21 C.F.R. § 1301.74(b) (the
regulation defining suspicious orders) and 21 C.F.R.
§ 1301.71(a) (the regulation defining effective controls against
the diversion of controlled substances). We need not opine on
DEA’s statutory authority to use an adjudication to modify a
rule enacted through notice and comment because the
Administrator neither created nor imposed any new duties. He
relied on the existing Reporting Requirement.
 19
A.

As already noted, section 1301.74(b) defines
“[s]uspicious” orders to “include orders of unusual size, orders
deviating substantially from a normal pattern, and orders of
unusual frequency.” 21 C.F.R. § 1301.74(b). According to
Masters, the rule creates an exhaustive list of the characteristics
that make an order for controlled substances suspicious, so that
the Administrator could not treat an order as “suspicious” for
any reason other than its size, pattern, or frequency without
effectively expanding the rule. For example, the Administrator
pointed to the fact that several pharmacies mostly sold
controlled substances, rather than the mix of controlled and
non-controlled medications typical for a bona fide retail
pharmacy, as among the indicia that the pharmacy might be
involved in illegal diversion. See, e.g, 80 Fed. Reg. at 55,484
(Administrator explaining that orders placed by Tru-Valu
pharmacy were suspicious, in part because 60 to 80 percent of
Tru-Valu’s medication sales were for controlled substances);
id. at 55,488 (Administrator explaining that orders placed by
Englewood Specialty Pharmacy were suspicious, in part
because “controlled substances prescriptions comprised nearly
70 percent of all prescriptions the pharmacy dispensed”); id. at
55,491-94 (Administrator explaining that orders placed by City
View Pharmacy were suspicious, in part because “60 percent
of the prescriptions filled by the pharmacy were for controlled
substances”). The Administrator also concluded that several
orders were suspicious because an unusually high percentage
of the pharmacy’s customers paid for controlled substances
with cash (the preferred payment method for illegitimate
prescriptions), rather than traceable methods such as credit
cards or health insurance. See id. at 55,488 (Administrator
explaining that orders placed by The Drug Shoppe were
suspicious, in part because “85 percent of the controlled
substance prescriptions it filled were paid for with cash”); id.
 20
at 55,484 (Administrator explaining that orders placed by Tru-
Valu pharmacy were suspicious, in part because Tru-Valu did
not accept insurance for all of its oxycodone products).
Similarly, orders from pharmacies that bought oxycodone from
Masters at a price higher than insurance would reimburse, but
did not also sell enough other medications or products to offset
such losses, raised suspicions that they sold oxycodone to the
black market at a higher price. See id. at 55,494 (Administrator
explaining that orders placed by City View Pharmacy were
suspicious, in part because Masters’ staff had documented
concerns about the pharmacy’s ability to “ma[k]e a profit”); id.
at 55,497 (Administrator explaining that orders placed by
Medical Plaza Pharmacy were suspicious, in part because it
was not clear “how the pharmacy could be making a profit
when insurance reimbursed at a lower rate ($32) than what
Master[s] charged for oxycodone ($39)”).

Contrary to Masters’ suggestion, the Administrator did not
impermissibly amend section 1301.74(b) when it held that the
rule does not exhaustively list characteristics that might make
a retail pharmacy’s order for large quantities of controlled
substances “suspicious.” See 80 Fed. Reg. at 55,473-74.
Section 1301.74(b) defines suspicious orders as “includ[ing]”
orders of an unusual size, pattern, or frequency, and it is well
established that the word “include” often precedes a list of
“illustrative” examples, rather than an exclusive list of indicia
of an identified wrong. Fed. Land Bank of St. Paul v. Bismarck
Lumber Co., 314 U.S. 95, 99-100 (1941); accord Alabama v.
North Carolina, 560 U.S. 330, 340-41 (2010). The
Administrator noted that Masters’ reading of section
1301.74(b) “would have ill-served the CSA’s purpose of
preventing the ‘illegal . . . distribution . . . possession and
improper use of controlled substances’” by failing to require
the reporting of an order so long as it was of typical size,
pattern, or frequency, even if a supplier actually knew “that a
 21
customer was ordering controlled substances from it for the
purpose of diverting them.” 80 Fed. Reg. at 55,473 (quoting
21 U.S.C. 801(2)). Reading section 1301.74(b)’s listed
characteristics as exemplary rather than exhaustive, DEA
reasonably concluded that other indicia may also raise
suspicions about an order for controlled substances. That
conclusion was entirely consistent with the text of the
regulation, as well as agency precedent. See, e.g., Southwood,
72 Fed. Reg. at 36,497, 36,501-02 (internet pharmacy’s orders
were suspicious because the pharmacy was buying an unusual
mix of controlled and non-controlled substances, dominated
overwhelmingly by controlled substances, which was not
consistent with what legitimate pharmacies typically ordered);
id. at 36,501 (supplier should have reported pharmacy’s orders
as suspicious after the supplier’s agent visited the pharmacy
and saw signs relating to mail-order business tied to an internet
pharmacy that mailed prescriptions out of state, suggesting that
the pharmacy was “filling . . . illegitimate prescriptions”).

B.

Second, Masters argues that the Administrator
impermissibly amended section 1301.71(a) without notice and
comment. That section imposes a general duty on
pharmaceutical distributors to “provide effective controls . . .
against [the] diversion” of controlled substances. 21 C.F.R.
§ 1301.71(a). The regulation requires the Administrator to
“use the security requirements set forth in §§ 1301.72-1301.76
as standards for the physical security controls and operating
procedures necessary to prevent diversion.” Id. Thus, in
Masters’ view, sections 1301.72 through 1301.76 set out the
only standards the agency may use to measure the effectiveness
of controls against diversion:
 22
These specifically enumerated “physical security
controls and operating procedures” do not require a
distributor to perform due diligence on its customers;
the only requirement is that distributors make a
“good faith inquiry” to verify that a customer has a
valid DEA and state registration. Id. § 1301.74(a).
Distributors also have an obligation to identify and
report to DEA “suspicious orders,” which “include
orders of unusual size, orders deviating substantially
from a normal pattern, and orders of unusual
frequency.” Id. § 1301.74(b).

Pet’r Br. 46. Masters insists that the Administrator unlawfully
used this proceeding to create new legal obligations by
expansively reading existing law. Foremost, Masters
complains that the Administrator elaborated on the Shipping
Requirement. As noted above, the Shipping Requirement
mandates that pharmaceutical companies exercise “due
diligence” before shipping any suspicious order. 72 Fed. Reg.
at 36,500. DEA first articulated that requirement in
Southwood, 72 Fed. Reg. at 36,501, and Masters claims that the
Administrator expanded on it here. See 80 Fed. Reg. 55,476.
First in Southwood and then in this case, Masters contends, the
Administrator amended the regulatory scheme by tacking the
Shipping Requirement onto the settled list of “security
requirements” stated in sections 1301.72–1301.76.

Notably, however, the Administrator’s holding rests on
Masters’ violation of the Reporting Requirement, not the
Shipping Requirement. The Administrator’s Decision and
Order summarized his reasoning and “conclude[d] that
[Masters] ha[d] not substantially complied with 21 CFR [§]
1301.74(b)”—the Reporting Requirement. 80 Fed. Reg. at
55,500-01. Consequently, even if the Administrator
expansively read the Shipping Requirement, that reading had
 23
no effect on his ultimate decision, and so provides no basis for
relief. See 5 U.S.C. § 706.

Similarly, Masters insists that the Administrator used this
proceeding to create a handful of highly specific security
requirements that are unrelated to the Shipping Requirement.
Specifically, Masters protests that the Administrator
announced that

[1] “[A] distributor must use the URs in evaluating
whether a customer’s [ratio of controlled to non-
controlled drug sales] is suspicious” (JA 555); [2]
“[e]ven if the Agency’s regulations do not require a
distributor to document the reason provided by a
customer to justify a suspicious order, documenting
that reason is still an essential part of maintaining
effective controls . . .” (JA 563 n.21); . . . [3] “the
distributor must conduct ‘additional investigation to
determine whether [its customer is] filling legitimate
prescriptions’” (JA 612) . . . ; and [4] “investigation
[into a suspicious order] must dispel all red flags
indicative that a customer is engaged in diversion
. . .” (JA 613).

Pet’r Br. 47-48.

Contrary to Masters’ suggestion, however, none of those
statements created new security requirements. Rather, the
statements collectively explained what a distributor in Masters’
position must do if, instead of immediately reporting to DEA
all orders of an unusual size, frequency, or pattern, it chooses
to use the SOMS—or an equivalent program—to seek to dispel
the suspicion surrounding such orders and report only those
that still appear suspicious after investigation. As we have
emphasized throughout this opinion, it is not necessary for a
distributor of controlled substances to investigate suspicious
 24
orders if it reports them to DEA and declines to fill them. But
if a distributor chooses to shoulder the burden of dispelling
suspicion in the hopes of shipping any it finds to be non-
suspicious, and the distributor uses something like the SOMS
Protocol to guide its efforts, then the distributor must actually
undertake the investigation. For example, when an employee
uses the SOMS Protocol to confirm or dispel suspicion based
on the amount of controlled medication the pharmacy is selling,
the employee must request a “UR,” i.e., a document showing
the pharmacy’s “actual dispensing[s] . . . of each drug.” 80
Fed. Reg. at 55,420. Moreover, the investigating employee
must “document” customers’ explanations for suspicious
orders, so that he or she can verify those explanations and make
sure they are consistent over time. Id. at 55,428 n.21.
Additionally, if a customer’s explanation for its order is
“inconsistent with other information the [investigator] has
obtained about or from the customer, . . . the [investigator]
must conduct ‘additional investigation to determine whether
[its customer is] filling legitimate prescriptions.’” Id. at
55,477. Finally, the investigation must dispel all of the “red
flags” that gave rise to the suspicion that the customer was
diverting controlled substances. Id. at 55, 478. The
Administrator recognized that, if investigating employees fail
to take such basic steps, the SOMS (or similar protocol) does
not function as an effective tool for dispelling suspicion.

IV.

Next, Masters contends that the Administrator’s decision
violates its rights under the 2009 Settlement Agreement with
DEA. In that agreement, DEA released Masters from liability
and agreed to refrain from filing new administrative claims
against it based on conduct alleged in the agreement and the
2008 Order to Show Cause, all of which occurred before April
1, 2009. J.A. 898-99. DEA also committed to reviewing
 25
Masters’ “diversion compliance program” (i.e., the SOMS)
within the first 180 days that the Settlement Agreement was in
effect to determine whether it satisfactorily guarded against
diversion. Id. at 901-02. Masters contends that DEA reneged
on both of those promises, so cannot now rely on Masters’ pre-
April 2009 conduct or inadequacies in the SOMS to support its
revocation of Masters’ certificate of registration.

A.

Masters asserts that it is being penalized for failing to
report suspicious orders placed before April 1, 2009, in
violation of the Settlement Agreement. See J.A. 899. As
Masters notes, the Administrator repeatedly cited Masters’ pre-
April 2009 interactions with customers. The Administrator,
however, only referred to those interactions to demonstrate
Masters’ knowledge of its customers’ suspicious business
practices, which should have prompted Masters to be
especially scrupulous in reporting suspicious orders placed by
those customers after April 1, 2009. For example, the
Administrator noted that, in September 2008, Englewood
Specialty Pharmacy requested that Masters increase its
oxycodone purchasing limit. 80 Fed. Reg. at 55,488. In
making that request, Englewood’s staff told Masters that 30 per
cent of the prescriptions it filled were for controlled
substances—a figure belied by Englewood’s then-current
utilization report showing that nearly 70 per cent of the
prescriptions Englewood filled were for controlled
medications. Id. Just two months later, in November 2008,
Masters sent a consultant to visit Englewood, who reported that
Englewood “appear[ed] to be doing a larger narcotic business
than [it] admit[ed].” Id. at 55,488-89. In light of the strong
evidence that Englewood had a history of lying to Masters to
obtain narcotics, the Administrator concluded that Masters
should have reported as suspicious Englewood’s unusually
 26
large post-settlement-period orders for oxycodone. See id.
That conclusion was entirely consistent with the Settlement
Agreement. J.A. 903 (reserving DEA’s right to admit evidence
of pre-settlement conduct “for proper evidentiary purposes” to
establish Masters’ liability “for non-covered conduct”).

B.

Masters also claims that it detrimentally relied on DEA’s
commitment to review the SOMS and inform Masters if it
found either component of the SOMS (the Computer Program
or the Compliance Protocol) to be inadequate. As noted above,
DEA represented in the Settlement Agreement that, within 180
days of the agreement’s April 1, 2009, effective date—i.e., by
July 30, 2009—DEA would visit Masters’ “distribution center”
and “conduct a review of the functionality of Master[s]’
diversion compliance program” (the Compliance Review).
J.A. 901-02. DEA further represented that, “[a]t the conclusion
of the Compliance Review, DEA [would] conduct an exit
interview with appropriate Masters representatives to provide
DEA’s preliminary conclusions regarding the Compliance
Review.” Id. at 902. Finally, DEA agreed that, if the
Compliance Review was unsatisfactory, DEA would
“provide[] written notice with specificity to Masters on or
before 220 days from the [e]ffective [d]ate of [the Settlement
Agreement].” Id.

It is undisputed that the Compliance Review did not
completely fulfill the parties’ expectations. “[B]ecause the
new policies had been implemented on August 14, 2009, only
four days before the Compliance Review, there was not enough
time to determine if the policies were being properly
implemented.” 80 Fed. Reg. at 55,425. DEA nonetheless
conducted a Compliance Review on August 17 and 18, 2009.
DEA’s Diversion Investigators provided Masters’ personnel
 27
some training regarding distributors’ obligations under the
Controlled Substances Act, discussed specific concerns about
certain of Masters’ past practices and customers and warned
Masters not to continue such dealings, and gave some
additional guidance on how to detect illegitimate dispensing of
controlled substances. Id. at 55,422-23. Masters, for its part,
briefed the investigators on its drug handling policies and
procedures, including its SOMS. Id. at 55,423-25. The SOMS
had been put in place so recently that neither party could rely
on the formal “exit interview” contemplated by the Settlement
Agreement as assurance that the SOMS, as Masters actually
operated it, brought the company into compliance with its
obligations under the Controlled Substances Act. Id. at 55,425.
Instead, what an investigator told Masters was that its written
“policies and procedures” for the SOMS, “if properly
implemented” by Masters’ personnel, “could promote an
effective system to detect and prevent diversion of controlled
substances.” Id.

According to Masters, much of the conduct on which the
Administrator relied in these proceedings should have been
apparent to DEA investigators during the Compliance Review.
Because Masters did not receive the written notice that DEA
promised to provide if it found the Compliance Review to be
“not satisfactory,” J.A. 902, and because of “DEA’s silence
following the Compliance Review,” Masters says that it
presumed that it was operating within the letter of the law.
Pet’r Br. 53-59. Masters therefore asserts that it was deprived
of a key benefit of the Settlement Agreement: an opportunity
to correct any shortfalls in its controlled substances program
before they triggered administrative action to revoke its
certificate. Masters contends that DEA is contractually bound
and equitably estopped from holding it responsible for any
deficiencies in the SOMS of which the agency did not
previously notify Masters in writing. See id. at 57-59.
 28
As the Administrator noted, the Settlement Agreement
provided no remedy for Masters in the event that DEA failed
to provide written notice of any observed deficiencies in
Masters’ SOMS; the key question is thus whether, in light of
the Settlement, DEA should be equitably estopped from
holding Masters to account for inadequacies in its diversion-
detection policies and practices that, according to Masters,
were reasonably observable in 2009 but not identified by DEA
in the Compliance Review. See J.A. 564 (citing Dantran, Inc.,
v. U.S. Dep’t of Labor, 171 F.3d 58, 66 (1st Cir. 1999) (holding
that an agency was not equitably estopped from imposing
liability on a party who relied on a “clean bill of health” from
government investigators)).

To estop the government, a regulated entity must show
that: (1) the government made a “definite representation”; (2)
on which the entity “relied . . . in such a manner as to change
[its] position for the worse”; (3) the entity’s reliance was
reasonable; and (4) “the government engaged in affirmative
misconduct.” Morris Commc’ns, Inc. v. FCC, 566 F.3d 184,
191 (D.C. Cir. 2009) (quoting Graham v. SEC, 222 F.3d 994,
1007 (D.C. Cir. 2000)). In this case, assuming that the
government made a “definite representation” to Masters that it
would identify problems with the SOMS within 220 days of an
inspection, see 80 Fed. Reg. at 55,425, Masters has
demonstrated neither reasonable reliance on the statement nor
affirmative government misconduct.

There is no evidence of reliance on Masters’ part. If
Masters had waited 220 days after the effective date of the
Settlement Agreement to ensure that DEA had no quarrels with
the SOMS, and then rigorously implemented the SOMS as a
compliance strategy, Masters might be able to claim that it
relied on DEA’s statement about “written notice.” But that is
not what happened. Instead, following the Compliance
 29
Review—at which Masters presented and promised to follow
its brand-new SOMS—Masters’ employees consistently failed
to implement the SOMS Protocol. Consequently, Masters
cannot claim that it relied to its detriment on DEA’s review.

Even if Masters had shown that it actually relied on the
Administrator’s undertaking to provide written notice of any
problems with the SOMS, there are several reasons why it
would have been unreasonable to place great weight on such a
promise. At the time of the Compliance Review, the SOMS
was only three or four days old; consequently, Masters’
employees had no track record to show how they were
operating the SOMS in practice. The most DEA’s Diversion
Investigators were in a position to do is comment on the
adequacy of the SOMS Compliance Protocol on paper. Thus,
Masters could not reasonably believe that DEA’s failure to
provide written follow-up after the Compliance Review
amounted to approval of the way that Masters’ employees were
implementing—or failing to implement—the SOMS. In any
event, the Settlement Agreement expressly cautioned Masters
not to rely on the results of the Compliance Review, stating: “A
finding of ‘satisfactory’ [after the Review] does not otherwise
express DEA’s approval of Masters’ compliance program.”
J.A. 902.

And even if the DEA review addressed the SOMS in
operation, and even if Masters had reason to and did rely on
that review, there is no evidence suggesting that the
government engaged in the “affirmative misconduct”
necessary to sustain a claim of estoppel against the
government. Morris Commc’ns, Inc., 566 F.3d at 191. The bar
for establishing “affirmative misconduct” is high, requiring a
showing of “misrepresentation or concealment, or, at least,
behav[ior] . . . that . . . will cause an egregiously unfair result.”
GAO v. Gen. Accounting Office Pers. Appeals Bd., 698 F.2d
 30
516, 526 (D.C. Cir. 1983). Generally, “ordinary negligence”
does not qualify as egregiously unfair conduct. See Bowman v.
D.C., 496 F. Supp. 2d 160, 164 (D.D.C. 2007). Nor does a
simple failure to perform under a contract. See Morris
Commc’ns, Inc., 566 F.3d at 191-92 (government did not
engage in “affirmative misconduct” when it promised to act on
a waiver request in 30 days, but failed to do so for three years).
Here, Masters has not identified any governmental misconduct,
let alone extraordinary misconduct.

V.

Masters further contends that the Administrator’s decision
violated the APA insofar as it was based on Masters’ refusal to
accept responsibility for its alleged misconduct. Masters
believes the Secretary decertified it for refusing to accept
responsibility “before the hearing and before DEA had
established its prima facie case.” Pet’r Br. 52. Such adverse
action would be inconsistent with DEA rules that guarantee
regulated parties an evidentiary hearing. 21 C.F.R. §§ 1301.41-
46 (DEA hearing regulations). Thus, Masters concludes, the
Administrator violated the provisions of the APA that require
agency decisions to be “in accordance with law” and to follow
the “procedure[s] required by law.” See 5 U.S.C. § 706 (2)(a),
(d).

Contrary to Masters’ suggestion, the Administrator did not
decertify Masters for putting DEA to its proof. As the
Administrator recently explained, DEA has “never held”—in
Masters’ case or any other—that “a respondent must admit to
[its] misconduct prior to even being able to test the
Government’s evidence at [a] hearing.” Hatem M. Ataya, M.D,
81 Fed. Reg. 8,221, 8,224 (Drug Enf’t Admin. Feb. 18, 2016).
Rather, under longstanding DEA precedent, once DEA
presents enough evidence at a hearing to show that a registered
 31
vendor or distributor of controlled substances has “committed
acts inconsistent with the public interest,” the “registrant must
present[] . . . mitigating evidence” including evidence that it
has “accept[ed] responsibility for its actions and
demonstrate[d] that it will not engage in future misconduct.”
Medicine Shoppe—Jonesborough, 73 Fed. Reg. 364, 387
(Drug Enf’t Admin. Jan. 2, 2008) (internal quotation marks
omitted). In this case, the government came forward with
ample evidence that Masters committed acts inconsistent with
the public interest by failing to report suspicious orders.
Masters presented no responsive evidence showing that it had
recognized the consequences of its misconduct. In fact, before
trial, Masters went so far as to stipulate that it did “not accept
responsibility for any alleged wrongdoing.” J.A. 153.

Furthermore, Masters’ refusal to admit fault played only a
minor role in the Administrator’s decision to revoke Masters’
certificate. The Administrator emphasized that, because
Masters’ Compliance Protocol was “rarely, if ever followed,”
Masters failed to investigate “hundreds of suspicious orders”
for opioids. 80 Fed. Reg. at 55,501. That failure amounted to
an “extensive and egregious” violation of DEA regulations. Id.
The Administrator found that the “egregiousness” of the
violation was “exacerbated” by the fact that Masters’ officials
were “well aware of the oxycodone epidemic.” Id. Finally, the
Administrator noted “the Agency’s interest in deterring future
misconduct.” Id. In light of all those considerations, we
conclude that, regardless of whether Masters accepted
responsibility for its misconduct, the Administrator would have
revoked its certificate of registration. Given the evidence of
Masters’ failure to maintain effective controls against diversion
of controlled substances and the absence of mitigating evidence
of Masters’ acceptance of responsibility, the Administrator’s
decision to revoke Masters’ certificate of registration was
reasonable and supported by substantial evidence.
 32
VI.

Finally, Masters contends that the Administrator violated
its due process rights by relying on arguments and evidence
that were not presented during the administrative trial. The
Due Process Clause gives regulated parties the right to fair
notice of the arguments and evidence against them. NLRB v.
Blake Constr. Co., 663 F.2d 272, 279 (D.C. Cir. 1981). An
agency may not rely on evidence or arguments that were not
discussed at a hearing as a basis for punishing a regulated party.
See id. Masters contends that the Administrator impermissibly
did just that: He relied on arguments DEA had forfeited and
evidence the ALJ had excluded as grounds to revoke Masters’
certificate of registration.

A.

In particular, Masters claims that the Administrator relied
on two points that DEA failed to preserve: (1) by April 1, 2009,
Masters had gathered information that the seven Florida-based
pharmacies listed in the 2013 OSC were potentially selling
opioids illegally; and (2) certain orders placed by those
pharmacies were suspicious because of their size, pattern, or
frequency, rather than the characteristics of the pharmacy
placing the order. Masters insists that those arguments were
not presented to the ALJ or the Administrator, depriving
Masters of any opportunity to refute them. Once again,
Masters’ argument is belied by the record.

Contrary to Masters’ suggestion, DEA never forfeited the
argument that, by April 1, 2009, Masters was on notice that the
seven pharmacies might be selling opioids illicitly. DEA
argued pretrial that “pre-April, 2009 evidence [would] be
offered [at trial] to show that Masters had knowledge of
potential problems with certain customers.” Order Granting in
Part Respondent’s Motion in Limine to Preclude Admission of
 33
Irrelevant, Immaterial, and/or Incompetent Evidence and to
Adopt Findings at 5, Masters Pharm., Inc., No. 13-39 (Feb. 7,
2014), J.A. 161. The ALJ then ruled that DEA could use pre-
April, 2009, evidence. Following that ruling, Masters admitted
in evidence its 2008 business records. DEA witness James
Rafalski then testified that, given the information in Masters’
2008 records, Masters should have known that the Seven
Pharmacies engaged in patterns of conduct suggesting that they
might be involved in illicit opioid sales, including: telling
Masters that it was dispensing a relatively low quantity of
controlled substances during periods when utilization reports
showed that it was in fact dispensing suspiciously high
quantities of controlled substances; conducting a high
percentage of its controlled substance sales with cash; and
selling an unusually high ratio of controlled to non-controlled
medications. For example, Diversion Investigator Rafalski
provided written testimony that, in light of Masters’ 2008
records for Englewood, Masters should have been cautious
about any of Englewood’s orders for controlled substances.
See J.A. 1151-54. As noted above, those records contain a
report from a Masters investigator noting that Englewood’s
pharmacist seemed to be lying about his controlled substance
sales. Id. at 1153. In addition, Englewood’s utilization report
dated September 22, 2008, “revealed that approximately 80%
of all pharmaceuticals [it] dispensed were controlled
substances.” Id. at 1154. According to Rafalski, Masters’ 2008
files for other customers raised similar concerns, yet Masters
paid no special attention to those customers’ orders for
controlled medications. Thus, in its proposed findings of fact
and conclusions of law, DEA argued that Masters’ customer
files—which included the 2008 records—“revealed numerous
red flags . . . that were regularly ignored.” Id. at 297. On this
record, Masters cannot credibly claim that DEA forfeited its
arguments based on pre-April 2009 evidence, or that it lacked
fair notice that DEA would rely on that evidence. Cf. Katz v.
 34
SEC, 647 F.3d 1156, 1161-62 (D.C. Cir. 2011) (regulated party
had fair notice that the SEC would rely on “false account
statements,” where an administrative hearing officer denied a
motion to strike those statements and the statements were later
introduced at the administrative trial).

Masters makes a similarly unsupported assertion that
“DEA never identified in its [2013 Order to Show Cause],
prehearing statements, or written or oral testimony[,] a single
order for controlled substances . . . that DEA deemed
suspicious due to its unusual size, its deviation from a usual
pattern, or its unusual frequency.” Pet’r Br. 31. “Likewise,”
Masters protests, “DEA never alleged that every order held for
review by [the Computer Program] was per se suspicious . . .
unless Masters obtained and independently verified the reason
for the order.” Id. Masters accordingly objects to the
Administrator’s reliance on Masters’ inadequate response to
held orders.

We are somewhat mystified by this argument. Before the
administrative trial began, DEA provided Masters a copy of the
written testimony of DEA Diversion Investigator Rafalski. In
that testimony, Rafalski stated that, in his conversations with
Masters’ staff, he learned that the SOMS computer program
was designed to hold orders of an unusual size, pattern, or
frequency. J.A. 1124. That testimony was confirmed by
Masters’ policy manual, which states that the SOMS Computer
Program was designed to hold “all orders for controlled drugs
that meet or exceed the criteria set out in 21 C.F.R. [§]
1301.74(b),” i.e., orders of unusual size, pattern, or frequency.
Id. at 1436. Echoing that evidence, DEA’s proposed findings
of fact and conclusions of law: (a) noted that the Computer
Program held orders of an unusual “size, pattern, or
frequency”; and (b) asserted that Masters’ failure to follow its
own policies—including the policy requiring Masters to
 35
“discern the reason for [an order’s] deviation in size, pattern,
or frequency”—rendered Masters’ system for complying with
DEA regulations ineffective. Id. at 296. Thus, Masters had
ample opportunity to consider and rebut the proposition that
orders held by the Computer System were orders of a
suspicious size, pattern, or frequency, which Masters had a
legal obligation to report or investigate.

B.

1.

Masters also insists that the Administrator violated its due
process rights by relying on excluded evidence. Specifically,
Masters claims that the ALJ ordered the exclusion of
“information Masters gathered” before April 1, 2009, but that
the Administrator nonetheless relied on the excluded
information in determining that Masters should have
questioned orders placed by the Seven Pharmacies. Pet’r Br.
at 27-29. Masters points to the Administrator’s reliance on
information that Masters gathered in December 2008 to support
his conclusion that Masters should have been suspicious of
later orders placed by Tru-Valu, and similar reliance on
information Masters gathered “prior to April 1, 2009” to
support his conclusion that Masters should have suspected The
Drug Shoppe, Englewood, City View, Superior, and
Morrison’s. Id.

The ALJ’s ruling specifically permitted DEA to rely on
pre-April 1, 2009, information to “show that Masters had
knowledge of potential problems with certain customers” that
should have informed its later interactions with those
customers; Masters’ contrary contention fails to acknowledge
the role the ALJ reserved for evidence of Masters’ earlier
exposure to certain pharmacies. J.A. 161. What the ALJ ruled
off-limits was any administrative liability on Masters’ part for
 36
alleged violations of DEA regulations before April 1, 2009.
But the ALJ held that the Administrator could—and he did—
introduce evidence of Masters’ long-held knowledge that
certain pharmacies had been operating in ways strongly
suggesting that they were diverting controlled substances,
including its knowledge of operations reaching back before
April 2009. Evidence of Masters’ pre-April 2009 experiences
highlighted that Masters should have been particularly diligent
in reviewing orders placed by certain known, rogue
pharmacies. That evidence permissibly bolstered the
Administrator’s conclusions that, when Masters failed to
investigate and report suspicious orders those same pharmacies
placed after August 18, 2009, it violated the regulations. That
use of pre-April 1, 2009, information was expressly permitted
by the ALJ’s pretrial order.

2.

Masters further contends that the Administrator violated
its due process rights by relying on evidence that the ALJ
excluded regarding Masters’ misconduct between April 1,
2009, and August 18, 2009. That was the post-settlement
period when Masters was setting up its new compliance
program and DEA was evaluating the program. The
Administrator determined that the ALJ should not have
excluded that evidence; as he explained, “[n]othing in the
[Settlement Agreement] provided [Masters] with immunity for
potential violations [of the Controlled Substances Act] during
[that time].” See 80 Fed. Reg. at 55,429 n.22. Consequently,
the Administrator’s decision repeatedly refers to Masters’
failure to report suspicious orders of controlled substances
between April and August of 2009.

On this point, we conclude that Masters’ claim of error is
well founded. Even though the Administrator permissibly held
 37
that the ALJ’s evidentiary ruling was wrong, the Administrator
could not proceed to rely on the excluded evidence of Masters’
misconduct during the post-settlement review period. Doing
so would be in derogation of Masters’ right to respond to it.
Because the ALJ had excluded the evidence, however, Masters
had no need or opportunity during the administrative trial to
exercise its right to respond.

The Administrator’s error did not, however, rise to the
level of a due process violation. Crucially, the Administrator
recognized that reliance on that transition-period evidence
might be impermissible. Id. at 55,501 n.198. He was thus
careful to note that any discussion of that evidence was dicta:
Even setting the disputed evidence aside, the Administrator
explained, “the scope of [Masters’] failure to report suspicious
orders following the [C]ompliance [R]eview [was] so
extensive and egregious that I would come to the same
conclusion that the revocation of [Masters’] registration is
warranted to protect the public interest.” Id. Because the
Administrator did not base his holding on the excluded
evidence, Masters was not unlawfully deprived of its right to
contest it. Cf. SEC v. Whittemore, 659 F.3d 1, 13 (D.C. Cir.
2011) (erroneous admission of evidence did not violate
“substantial rights” where the evidence “was not
determinative” of the outcome).

3.

Masters contends that the Administrator also erred in
considering other excluded evidence. As is relevant here, the
ALJ’s pretrial order instructed the government not to rely on
paragraphs 6 and 24 of DEA Diversion Investigator Kyle
Wright’s declaration. Nevertheless, Masters asserts, the
Administrator cited those paragraphs in his decision. Even if
the Administrator erroneously cited the excluded paragraphs
 38
from Investigator Wright’s testimony, both of those paragraphs
address Masters’ alleged misconduct before August 2009. See
J.A. 163. As discussed above, the Administrator’s decision
was fully supported by evidence of Masters’ failure to report
suspicious orders after that date. See 80 Fed. Reg. at 55,501
n.198. Thus, for the reasons stated in the previous section, the
Administrator’s mention of the excluded portions of
Investigator Wright’s testimony was consistent with Masters’
due process rights.

***

Because Masters has not identified any prejudicial errors
in the Administrator’s decision, we deny Masters’ petition for
review.