Controlled substances: records built for the inspector

Context

Veterinary practices that handle controlled substances carry much of the federal exposure a pharmacy does, with a fraction of the staff. They keep Schedule II through V drugs on site, log every dose, and answer to inspectors who can arrive unannounced. The job here was never ‘log doses.’ It was an owner who can sleep through inspection season knowing the records will hold.

The problem

Done the usual way, these records are paper logbooks and spreadsheets, and they fail quietly. An entry gets corrected after the fact and nobody can prove when or by whom. A monthly binder reconciliation eats hours of a technician’s week. Then an inspection lands and the practice spends days reassembling what should be a single question. A gap is not a bug here. It is a federal recordkeeping finding against the license the whole practice runs on.

What I built

• A record nobody can quietly rewrite, including the owner. Every entry is sealed to the one before it in a chain, and a correction is a new signed entry that points back at the one it fixes. Change or delete anything after the fact and the seal breaks where it happened, in plain view.
• Time that cannot be backdated. Every entry is stamped by the server’s own clock, not the laptop that typed it, so ‘when’ is not something a user can wind back.
• Access decided by the records themselves, not just the screen. Who may see or touch an entry is enforced at the data, so a second app or a stray script cannot reach around the rules. One site can never read another’s records.
• Two people to waste a dose, enforced by the system, not the honor code. The witness signs from their own credential within a few minutes, and the software refuses to save a waste record without a real, distinct second person behind it.
• Built to the recordkeeping requirements of 21 CFR Part 1304. The 24-month ‘readily retrievable’ window is written straight into the report that produces the inspector’s history.

Results

What a practice gets on demand is the artifact an inspection actually asks for: a complete dispensation history and a live running balance for any substance across Schedules II through V, in the form an inspector wants it. Behind that view are 957 automated checks passing with none failing, and the whole rebuild was done by one person in about six weeks, with every release signed off only after an adversarial review tried and failed to break it.