Masters Pharmaceutical, Inc. v. DEA , 861 F.3d 206 ( 2017 )


Menu:
  •  United States Court of Appeals
    FOR THE DISTRICT OF COLUMBIA CIRCUIT
    Argued January 12, 2017                Decided June 30, 2017
    No. 15-1335
    MASTERS PHARMACEUTICAL, INC.,
    PETITIONER
    v.
    DRUG ENFORCEMENT ADMINISTRATION,
    RESPONDENT
    On Petition for Review of a Final Order
    of the Drug Enforcement Administration
    Richard T. Lauer argued the cause for petitioner. With
    him on the briefs were John A. Gilbert Jr., Karla L. Palmer,
    and Andrew J. Hull.
    Nicolas Riley, Attorney, U.S. Department of Justice,
    argued the cause for respondent. With him on the brief were
    Benjamin C. Mizer, Principal Deputy Assistant Attorney
    General, and Mark B. Stern, Attorney. Anita J. Gay and Lena
    D. Watkins, Attorneys, entered appearances.
    Gregory G. Garre, Philip J. Perry, Andrew D. Prins,
    Alexandra Shechtel, Richard L. Frank, David L. Durkin, and
    Donald L. Bell II were on the brief for amici curiae Healthcare
    Distribution Management Association and National
    Association of Chain Drug Stores in support of neither party.
    2
    Larry P. Cote was on the brief for amicus curiae Generic
    Pharmaceutical Association in support of neither party and in
    support of neither affirmance nor reversal.
    Before: SRINIVASAN and PILLARD, Circuit Judges, and
    EDWARDS, Senior Circuit Judge.
    Opinion for the Court filed by Circuit Judge PILLARD.
    PILLARD, Circuit Judge:           Breakthroughs in the
    development of prescription opioid painkillers have vastly
    increased their popularity. But that popularity has taken a toll.
    Opioids are heavily addictive and often lethal in high doses.
    The Drug Enforcement Administration (DEA or agency) has
    therefore listed opioids such as hydrocodone and oxycodone as
    controlled substances so that DEA can monitor and restrict
    their sale. Over the past two decades, DEA has been battling a
    steep increase in prescription opioid abuse—a problem that
    DEA views as an “epidemic.” U.S. Dep’t of Justice, Drug Enf’t
    Admin., Order to Show Cause (Aug. 9, 2013), J.A. 8-9. The
    Department of Health and Human Services (HHS), too, sees
    the rising abuse of prescription opioids as “a serious and
    challenging” public health issue. DEP’T OF HEALTH & HUMAN
    SERVS., OPIOID ABUSE IN THE U.S. AND HHS ACTIONS TO
    ADDRESS OPIOID-DRUG RELATED OVERDOSES AND DEATHS
    (2015). Since 1999, the number of deaths from prescription
    painkillers in the United States has more than quadrupled.
    CENTERS FOR DISEASE CONTROL AND PREVENTION, Opioid
    Overdose:           Understanding         the         Epidemic,
    https://www.cdc.gov/drugoverdose/epidemic/index.html (last
    visited June 12, 2017). Prescription opioids now kill an
    average of 44 Americans per day. U.S. DEP’T OF HEALTH &
    HUMAN           SERVS.,        About       the        Epidemic,
    3
    https://www.hhs.gov/opioids/about-the-epidemic (last visited
    June 12, 2017).
    Masters Pharmaceuticals, Inc., (Masters) supplies
    prescription medications in bulk to pharmacies across the
    United States. Before this litigation began, Masters was
    registered with DEA as a vendor of controlled substances,
    including opioids. As a registrant, Masters had an obligation
    to report to DEA suspicious orders for controlled substances
    and to take other precautions to ensure that those medications
    would not be diverted into illegal channels.
    This case challenges DEA’s 2014 decision to revoke
    Masters’ certificate of registration, without which Masters
    cannot sell controlled substances. The revocation order turned
    on DEA’s conclusion that Masters had shirked its legal
    obligation to report suspicious orders for controlled substances.
    Masters challenges the factual basis of DEA’s revocation
    decision, and claims it exceeded DEA’s authority under its
    existing regulations, effectively broadening them in a manner
    that was inconsistent with the Administrative Procedure Act
    (APA). In addition, Masters suggests, DEA improperly relied
    on arguments and evidence that were not presented during the
    administrative trial, in violation of the Due Process Clause.
    Because we see no prejudicial error in DEA’s decision, we
    deny Masters’ petition for review.
    I.
    A.
    The Controlled Substances Act authorizes commercial
    distribution of certain controlled substances for therapeutic use,
    but requires all distributors to register with DEA. See 
    21 U.S.C. § 823
    (b), (e); 
    28 C.F.R. § 0.100
    . The Administrator of
    DEA (the Administrator) closely observes registered
    4
    distributors to ensure that their operations are “[]consistent
    with the public interest.” 
    21 U.S.C. § 824
    (a)(4); see also 
    28 C.F.R. § 0.100
    ; 
    21 C.F.R. § 1301.71
    . In evaluating a
    distributor’s operations, the Administrator considers: (1)
    whether the distributor has maintained “effective control[s]
    against diversion of particular controlled substances into other
    than legitimate medical, scientific, and industrial channels”; (2)
    whether the distributor has complied with applicable state and
    local laws; (3) whether the distributor has previously been
    convicted under federal or state laws for a crime related to the
    sale of controlled substances; (4) the distributor’s past
    experience with controlled substances; and (5) “such other
    factors as may be relevant to and consistent with the public
    health and safety.” 
    21 U.S.C. § 823
    (b), (e). The Administrator
    is “not required to make findings as to all of the[se] factors,”
    and “may give each factor the weight he deems appropriate.”
    Morall v. DEA, 
    412 F.3d 165
    , 173-74 (D.C. Cir. 2005) (internal
    quotation marks omitted). If the distributor’s operations fail to
    live up to the public-interest standard, the Administrator may
    “suspend[] or revoke[]” the distributor’s certificate. 
    21 U.S.C. § 824
    (a)(4).
    Where, as here, the Administrator considers the first
    factor—the maintenance of “effective controls” against the
    “diversion” of controlled substances—the Administrator must
    determine whether the registrant complied with DEA’s
    “security requirements.” 
    21 C.F.R. § 1301.71
    (a). The
    “security requirement” at the heart of this case mandates that
    distributors “design and operate a system” to identify
    “suspicious orders of controlled substances” and report those
    orders to DEA (the Reporting Requirement). 
    21 C.F.R. § 1301.74
    (b). The Reporting Requirement is a relatively
    modest one: It requires only that a distributor provide basic
    information about certain orders to DEA, so that DEA
    “investigators in the field” can aggregate reports from every
    5
    point along the legally regulated supply chain and use the
    information to ferret out “potential illegal activity.”
    Southwood Pharm., Inc., 
    72 Fed. Reg. 36,487
    , 36,501 (Drug
    Enf’t Admin. July 3, 2007). Once a distributor has reported a
    suspicious order, it must make one of two choices: decline to
    ship the order, or conduct some “due diligence” and—if it is
    able to determine that the order is not likely to be diverted into
    illegal channels—ship the order (the Shipping Requirement).
    See 
    id. at 36,500
    .
    B.
    On October 17, 2008, a DEA Deputy Assistant
    Administrator issued an order to show cause why DEA should
    not revoke Masters’ certificate of registration (the 2008 Order
    to Show Cause, or 2008 Order). U.S. Dep’t of Justice, Drug
    Enf’t Admin., Order to Show Cause (Oct. 17, 2008). That
    Order alleged that Masters had “failed to maintain effective
    controls against diversion” of hydrocodone, a powerful opioid.
    Id.; see also Masters Pharm., Inc., 
    80 Fed. Reg. 55,418
    , 55,421
    (Drug Enf’t Admin. Sept. 15, 2015). “Throughout 2007 and
    2008,” Masters violated the Reporting Requirement by failing
    to notify DEA when “rogue Internet pharmacies” placed
    suspicious hydrocodone orders. 80 Fed. Reg. at 55,421-22. In
    addition, Masters allegedly filled those hydrocodone orders
    without performing adequate due diligence, in violation of the
    Shipping Requirement. See 80 Fed. Reg. at 55,421-22.
    On April 1, 2009, DEA and Masters agreed to settle the
    charges in the 2008 Order. The settlement agreement required
    Masters to pay $500,000 to the agency and bring the company
    into compliance with DEA regulations by implementing a
    compliance system “to detect suspicious orders” for controlled
    substances and “prevent diversion of controlled substances”
    into illegal channels. Settlement and Release Agreement and
    6
    Administrative Memorandum of Agreement at 2 (Apr. 1,
    2009), J.A. 899. Masters further promised that orders
    “identified as suspicious” by the compliance system would “be
    reported to . . . DEA.” Id.
    To fulfill its obligations under the settlement agreement,
    Masters created a compliance system called the “Suspicious
    Order Monitoring System” or “SOMS,” consisting of a
    computer program (the Computer Program) and a protocol for
    Masters’ employees (the Compliance Protocol, or Protocol).
    The Computer Program was designed to identify any order for
    controlled substances that “me[t] or exceed[ed]” the criteria for
    suspicious orders set out in 
    21 C.F.R. § 1301.74
    (b). J.A. 1436.
    In other words, the computer program was designed to identify
    orders of an unusual “size,” “frequency,” or “pattern.” 
    21 C.F.R. § 1301.74
    (b). Thus, for each of the controlled
    medications that Masters sold, the Computer Program tracked
    the number of doses that Masters’ customers ordered over the
    preceding six calendar months. Each customer’s highest
    monthly total would then be treated as the customer’s
    “Controlled Substance Limit.” 80 Fed. Reg. at 55,423 n.12;
    see also J.A. 1395-96. If a customer ordered enough doses in
    any 30-day period to exceed its Controlled Substance Limit,
    the Computer Program would hold the customer’s most recent
    order for the medication so it could be reviewed by Masters’
    staff. The Computer Program also held the most recent order
    placed by a customer if the customer submitted more order
    forms in a 30-day period than it had in any of the prior six
    calendar months, or if the timing of the order did not comport
    with the customer’s general ordering pattern over those six
    months. J.A. 1397.
    Once an order was held, Masters’ staff would implement
    the SOMS Protocol, which required Masters’ staff to take
    specified steps to investigate the order and determine whether
    7
    it was legitimate. The SOMS Protocol required Masters’ staff
    to initiate the investigation by “call[ing] the customer” that
    placed the held order, “request[ing] . . . [a]n explanation,”
    documenting the customer’s response, and then “independently
    verify[ing]” the information that the customer provided.
    J.A. 1213, 1436. In addition, Masters’ staff was required to
    obtain a “current utilization report” from the ordering
    pharmacy—i.e., a list all of the controlled and non-controlled
    medications that the pharmacy dispensed in the most recent
    calendar month. Id. at 1436. Masters’ employees would then
    “examine[]” the pharmacy’s “entire file,” including its order
    history, survey responses, and records of any “site visit[s]”—
    i.e., occasions on which Masters’ staff physically observed
    customers’ premises for signs that they participated in the black
    market, id. at 1436, 1441, such as a long line of customers
    awaiting prescriptions at an odd time of day, 80 Fed. Reg. at
    55,484, or multiple cars in the pharmacy parking lot with out-
    of-state license plates, id. at 55,490. If the customer provided
    all of the information that Masters’ staff requested, and Masters
    determined that: (a) the held order was “consistent with the
    customer’s utilization report”; and (b) the “customer’s entire
    file, including survey responses and site visits, [was] consistent
    with legitimate business practices,” Masters’ staff could deem
    the order non-suspicious and ship it. J.A. 1436. Otherwise,
    Masters would treat the order as “suspicious,” report it to DEA
    as required by 21 CFR 1301.74(b), and decline to fill it.
    In the four years after Masters signed the Settlement
    Agreement, DEA grew concerned that Masters’ staff was
    failing to detect and report to DEA suspicious orders of
    oxycodone products, in violation of 21 C.F.R. 1301.74(b). On
    August 9, 2013, a Deputy Assistant Administrator of DEA
    issued a second order to show cause why Masters’ certificate
    of registration should not be revoked (the 2013 Order to Show
    Cause, or 2013 Order), alleging that “Masters consistently
    8
    ignored and/or failed to implement” its controlled substance
    policies and failed to comply with the Reporting Requirement.
    U.S. Dep’t of Justice, Drug Enf’t Admin., Order to Show Cause
    (Aug. 9, 2013), J.A. 10. The 2013 Order further alleged that
    Masters violated the Shipping Requirement by filling orders for
    millions of dosage units of oxycodone for eight illegitimate
    pharmacies in Florida and Nevada: Tru-Valu Drugs; The Drug
    Shoppe; Medical Plaza Pharmacy; Englewood Specialty
    Pharmacy; City View Pharmacy; Lam’s Pharmacy; Morrison’s
    RX; and Temple Terrace Pharmacy, doing business as Superior
    Pharmacy.
    Administrative Law Judge Gail Randall (the ALJ) tried the
    noncompliance allegations. She first concluded that Masters
    had substantially complied with the Reporting Requirement.
    From her perspective, Masters had a duty to report an order
    held by the Computer Program only if Masters’ staff
    determined that the pharmacy placing the order was “likely
    diverting controlled substances.” Recommended Findings of
    Fact, Conclusions of Law, and Decision of ALJ, Masters
    Pharm., Inc., No. 13-39, at 156 (June 19, 2014) (ALJ
    Decision). She thought Masters had shirked that duty on only
    one occasion, and that failure to report a single suspicious order
    did not warrant revocation of Masters’ certificate of
    registration. Id. at 201.
    For similar reasons, the ALJ also concluded that Masters
    had substantially complied with the Shipping Requirement.
    The ALJ held that, under the Shipping Requirement, a
    pharmaceutical distributor like Masters could ship an order for
    controlled substances if it conducted enough due diligence to
    guard against any likelihood that the order would be diverted
    into unlawful channels. ALJ Decision at 201 (quoting
    Southwood, 72 Fed. Reg. at 36,502).            And Masters’
    9
    investigation into orders held by the Computer Program was,
    in her view, sufficient to satisfy that standard.
    In an eighty-three page Decision and Order published in
    the Federal Register, the Acting Administrator rejected the first
    part of the ALJ’s recommendation, and concluded that Masters
    had repeatedly violated the Reporting Requirement. The
    Administrator explained that the ALJ’s suspicious-order
    analysis was legally flawed because it misapprehended the
    “standard for reporting an order as suspicious.” 80 Fed. Reg.
    at 55,478. The ALJ insisted that an order was suspicious only
    if Masters had found it “likely” that the order would be diverted
    away from legitimate medical or scientific channels, but the
    amount of evidence needed to raise a “suspicion” is “far lower”
    than the amount of evidence needed to show that something is
    “likely.” Id. A suspicion is merely “[t]he apprehension or
    imagination of the existence of something wrong based . . . on
    inconclusive or slight evidence.” Id. (quoting Black’s Law
    Dictionary 1,585 (9th ed. 2009)). With that definition in mind,
    the Administrator reviewed Masters’ SOMS manual and
    determined that any order held by the Computer Program was
    held due to its unusual size, frequency, or pattern, and DEA
    regulations expressly provide that deviations in size,
    frequency, or pattern are the sort of indicia that give rise to a
    suspicion and, unless the suspicion is dispelled, the obligation
    to report. See id. at 55,479; 
    21 C.F.R. § 1301.74
    (b).
    The record evidence showed that, on hundreds of
    occasions, Masters neither reported orders held by the SOMS
    Computer Program nor implemented the SOMS Protocol to
    dispel the suspicion surrounding held orders. For example, on
    numerous occasions, rather than conducting the investigation
    contemplated by the Protocol, Masters’ employees deleted held
    orders or reduced their size so that they would no longer trigger
    the hold. At other times, Masters’ employees did contact their
    10
    customers to obtain explanations for held orders, but simply
    accepted whatever the pharmacies told them, without taking (or
    documenting) requisite steps to determine whether the
    explanations were accurate or even plausible. Perhaps most
    problematically, when customers provided information that
    confirmed the suspicion surrounding orders held by the SOMS,
    Masters still failed to report the orders to DEA. The
    Administrator ultimately concluded that Masters’ frequent
    violations of the Reporting Requirement warranted revocation
    of Masters’ certificate of registration; he therefore had no need
    to consider whether Masters additionally violated the Shipping
    Requirement.
    II.
    Masters claims that the Administrator’s key factual
    findings are unsupported by the record.             As Masters
    acknowledges, we must accept the Administrator’s findings so
    long as they are supported by “substantial evidence.” 
    21 U.S.C. § 877
    . The substantial evidence test is “[h]ighly
    deferential to the factfinder,” New Valley Corp. v. Gilliam, 
    192 F.3d 150
    , 154 (D.C. Cir. 1999), requiring only such evidence
    that a “reasonable mind might accept as adequate to support a
    conclusion,” S.C. Pub. Serv. Auth. v. FERC, 
    762 F.3d 41
    , 54
    (D.C. Cir. 2014) (quoting Murray Energy Corp. v. FERC, 
    629 F.3d 231
    , 235 (D.C. Cir. 2011)). We cannot reverse the
    Administrator’s factual findings even if, had we been in his
    position, we “would have weighed the evidence differently.”
    Cumberland Coal Res., LP v. Fed. Mine Safety & Health
    Review Comm’n, 
    717 F.3d 1020
    , 1028 (D.C. Cir. 2013).
    Accepting that we view the Administrator’s factfinding
    deferentially, Masters still sees insufficient evidence to support
    some of his factual conclusions. Masters contends that the
    record contains inadequate evidence to support the
    11
    Administrator’s conclusions that: (1) whenever an order for
    controlled substances was held by the SOMS Computer
    Program, that order was presumptively “suspicious” under 
    21 C.F.R. § 1301.74
    (b); and (2) Masters’ employees rarely
    undertook the investigation required to dispel the suspicion
    surrounding held orders. After full consideration of the parties’
    briefs and arguments, and examination of the record and the
    careful and detailed decisions of the ALJ and the
    Administrator, we believe the Administrator’s conclusions are
    well founded.
    A.
    Masters first challenges the Administrator’s conclusion
    that any held order was suspicious under 
    21 C.F.R. § 1301.74
    (b)—at least unless Masters dispelled the suspicion
    through investigation. That conclusion, Masters insists, is
    inconsistent with the language of Masters’ Comprehensive
    Compliance Policy Manual, which provides that the Computer
    Program will flag all orders that have even the potential to be
    suspicious. According to Masters, the Manual contemplates
    that the Computer Program will “hold[] every order that is
    suspicious as defined in 
    21 C.F.R. § 1301.74
    (b),” as well as
    “many orders that are not suspicious.” Pet’r Br. 33. As a result,
    Masters insists, an order will “only be deemed” suspicious
    under Masters’ policies if it is held by the Computer Program
    and a Masters employee follows up and separately makes a
    determination that it is suspicious. Pet’r Br. 34-35.
    As an initial matter, Masters offers a strained reading of its
    Comprehensive Compliance Policy and Manual. The manual
    expressly states that the Computer Program “[h]olds all orders
    for controlled drugs that meet or exceed the [suspicious order]
    criteria set out in 
    21 C.F.R. § 1301.74
    (b)”—rather than orders
    that potentially meet or exceed those criteria. J.A. 1436. In
    12
    other words, the Computer Program was designed to hold
    orders that are suspicious within the meaning of the regulation,
    even as it gave Masters’ employees the opportunity—through
    the due-diligence investigation contemplated by the
    Compliance Protocol—to dispel the suspicion surrounding
    held orders.
    More fundamentally, the key question in this case is not
    whether held orders qualified as “suspicious” under Masters’
    policies; the question is whether they qualified as “suspicious”
    under 
    21 C.F.R. § 1301.74
    (b). Thus, while Masters frames its
    challenge on this point in substantial-evidence terms, the
    relevant inquiry is more legal than factual: It asks how far the
    language of the regulation reaches. Undertaking that legal
    exercise, the Administrator reasonably determined that all held
    orders were “suspicious” within the meaning of the regulation.
    Section 1301.74(b) provides that “[s]uspicious orders include
    orders of unusual size, orders deviating substantially from a
    normal pattern, and orders of unusual frequency.” Apparently
    tracking that regulatory language, the Computer Program held
    an order if: (a) that order—combined with other orders placed
    in the same 30-day period—requested more doses of a
    controlled medication than the pharmacy had requested in any
    of the previous six calendar months; (b) the pharmacy ordered
    a controlled medication more frequently in a 30-day period
    than it had in any of the previous six calendar months; or (c)
    the pharmacy’s ordering pattern for a controlled medication
    deviated in some other notable way from its ordering pattern
    over the previous six months. As a matter of common sense
    and ordinary language, orders that deviate from a six-month
    trend are an “unusual” and not “normal” occurrence. It was
    therefore entirely reasonable for the Administrator to hold that
    orders held by the Computer Program met the regulatory
    definition of “suspicious orders” unless Masters’ staff dispelled
    the suspicion. 80 Fed. Reg. at 55,479 n.164; see Auer v.
    
    13 Robbins, 519
     U.S. 452, 461 (1997) (explaining that courts must
    defer to an agency’s reasonable interpretations of its own
    regulations).
    Finally, Masters contends that it is impossible to identify
    whether a held order is suspicious within the meaning of DEA
    regulations until a Masters employee has completed the SOMS
    Protocol. But if we were to credit Masters’ assertion that “the
    SOMS . . . holds many orders that are not suspicious,” Pet’r Br.
    33, it would be even clearer that Masters failed to “operate” a
    “system” for sorting suspicious from non-suspicious orders, in
    violation of 
    21 C.F.R. § 1301.74
    (b). By taking the position that
    orders initially held by the SOMS Computer Program are not
    thereby identified as suspicious, Masters’ case that it complied
    rests entirely on whether the company carried out some other
    process that would identify suspicious orders. The process
    Masters contends it used to do that is the SOMS Protocol.
    Under that theory, an order can only be suspicious once an
    employee has run the SOMS Protocol from beginning to end.
    But, as the next section describes, the record contains
    overwhelming evidence that Masters’ employees routinely
    failed to implement the SOMS Protocol.
    B.
    Masters also contends that there is insufficient evidence to
    support the Administrator’s finding that Masters repeatedly
    failed to report orders held as suspicious, or to conduct the sort
    of investigation that could dispel the suspicion that such orders
    were at risk of diversion. We conclude that, to the contrary, the
    Administrator’s decision contains ample support for his
    specific findings of Masters’ failures, in violation of the
    regulations, to report suspicious orders.
    More particularly, as noted above, when the Computer
    Program held an order, Masters’ written Compliance Protocol
    14
    required that a Masters employee call the pharmacy that placed
    the order, request an explanation and a current utilization
    report, and conduct an investigation to independently verify the
    pharmacy’s information and explanation.             J.A. 1436.
    According to the written testimony of Wayne Corona, a full-
    time consultant for Masters who helped develop the SOMS, the
    Compliance Protocol required the investigating employee to
    document the results of his or her inquiry “in the due diligence
    file[]” for the pharmacy that placed the order, “specifically in
    the Memos for Record (‘MFR’).” J.A. 1213. Indeed, Corona
    emphasized that “documentation was the linchpin of th[e]
    whole system.” 80 Fed. Reg. at 55,427 n.19. In light of the
    essential documentation requirements, the Administrator
    scoured Masters’ files on the Florida-based pharmacies listed
    in the 2013 Order to Show Cause in an effort to discern what
    Masters’ staff had done to verify that held orders were not
    suspicious and so need not be reported.
    Those files are replete with evidence that Masters
    routinely failed to investigate held orders. Most strikingly, in
    lieu of reporting all held orders, Masters’ employees deleted
    some and edited others so that they appeared to be of a normal
    size and pattern, and then proceeded to fill them. While
    deleting or editing orders may have limited the amount of
    oxycodone flowing to Masters’ customers, that practice
    subverted the Reporting Requirement. The law requires
    registered suppliers like Masters to alert DEA when their retail-
    pharmacy customers attempt to obtain unusual amounts of a
    controlled substance, because such attempts are powerful
    evidence that the pharmacies are operating illegally.
    In other instances, Masters’ employees simply released
    orders from hold and filled them as written, again without
    reporting them to DEA or investigating to see whether they
    might dispel the suspicion that caused the order to be placed on
    15
    hold. For many of those orders, Masters had no record that any
    employee even took the initial investigative step of calling the
    ordering pharmacy. Records were absent despite Masters’
    representation to DEA that “[d]ocumentation on all orders held
    for review and their disposition are permanently retained.” 80
    Fed. Reg. at 55,428. As the Administrator noted, the lack of
    documentation was evidence that the phone calls never took
    place: “The absence of an entry [in business records], where
    an entry would naturally have been made if a transaction had
    occurred, should ordinarily be equivalent to an assertion that
    no such transaction occurred, and therefore should be
    admissible in evidence for that purpose.’’ Id. (quoting 5
    Wigmore, Evidence § 1531, at 463 (Chadbourn rev. 1974)
    (emphasis added)).
    Even when Masters’ employees took some steps to probe
    the reasons orders were held, their efforts were too tentative,
    pro forma, and incomplete to dispel suspicion, yet Masters
    failed to report the orders to DEA. Many of Masters’ files
    contain entries suggesting that a Masters employee called a
    pharmacy to request an explanation for a held order, but either
    failed to obtain any explanation or, if it got one, to make
    corresponding entries showing that the employee verified that
    explanation. In Masters’ file for City View pharmacy, for
    example, there are notes documenting Masters’ repeated calls
    to the pharmacy, see 80 Fed. Reg. at at 55,494, and notes
    documenting City View’s assertion that it needed large
    amounts of oxycodone because it was “servicing two small
    nursing homes and was near a medical center.” Id. at 55,493.
    But there is no record that a Masters employee “even obtain[ed]
    the names of the homes, let alone inquire[d] as to how many
    residents they had.” Id. Similarly, Masters determined that
    Superior Pharmacy had justified its request for large amounts
    of oxycodone because “Superior was filling prescriptions for a
    juvenile in-patient facility. However, [Masters] obtained no
    16
    information as to the type of treatment being provided by the
    facility, the number of patients it had, and whether its patients
    would even be treated with drugs such as oxycodone 30.” Id.
    at 55,499 (internal quotation marks omitted). In the same vein,
    Masters accepted Medical Plaza’s claim that it was ordering
    large amounts of oxycodone in part because it was “[i]n a
    medical building of 60 doctors,” without conducting any
    “inquiry into the practice specialties of these physicians and
    whether they would be prescribing such powerful narcotics as
    oxycodone 30 in the course of their medical practices.” Id. at
    55,458, 55,495 (internal quotation marks and brackets
    omitted).
    What limited investigative records Masters maintained
    also show that Masters’ employees rarely got customers’ recent
    utilization reports to place held orders in context. Without
    those reports (or some comparable information), Masters could
    not know what proportion of a pharmacy’s prescription
    business was controlled substances. It therefore could not
    confirm that the pharmacy’s dispensing practices were
    consistent with those of a legitimate business.
    Further, Masters’ records show that investigations into
    held orders often ended with an employee recording a
    demonstrably false explanation for the order, or with the
    employee’s harboring unresolved doubts about the order’s
    validity, yet failing to share those doubts with DEA. For
    instance, Masters’ employees often concluded that an order for
    controlled substances was justified because it was consistent
    with the pharmacy’s utilization report, even where there was
    no current utilization report on file or when the utilization
    report showed “highly suspicious” dispensing patterns. See,
    e.g., id. at 55,486, 55,500. In other cases, Masters’ employees
    said that orders were justified because they were within the
    Controlled Substance Limit established by the SOMS
    17
    computer program, despite the fact that the orders had been
    held because they violated that limit. See id. at 55,500.
    Finally, Masters’ employees frequently ended their
    investigations by noting that they were filling controlled
    substance orders “with reservation.” See, e.g., 80 Fed. Reg. at
    55,427, 55,432-33, 55,437-38, 55,448, 55,459.             Such
    “reservation[s]” suggest that Masters’ employees were
    dissatisfied with the explanations they received for particular
    controlled substance orders. Yet they repeatedly failed to
    report those orders to DEA. See id.
    Masters urges us to disregard the overwhelming evidence
    that it failed to conduct meaningful investigations into held
    orders, pointing to some contrary evidence in the record. In
    particular, Jennifer Seiple, Masters’ chief compliance officer,
    testified that Masters investigated all orders held by the
    Computer Program (even orders it edited or deleted). But the
    Administrator carefully considered evidence that Masters cited
    in its favor, including Ms. Seiple’s testimony, and found that
    the evidence was either implausible or unresponsive to the
    government’s evidence. See, e.g., 80 Fed. Reg. at 55,420 n.5,
    55,471 n.152, 55,483 n.174.
    In sum, the Administrator painstakingly explained the
    factual bases for his conclusions. He found that, when SOMS
    held an order, Masters routinely neither reported to DEA nor
    took even a single investigative step. Faced with orders that
    were suspicious for the core reasons in the regulation—unusual
    size, pattern, or frequency—Masters’ employees frequently
    simply brushed suspicion under the rug by deleting orders or
    paring them down and shipping them without reporting them
    to DEA.       They also, time and again, simultaneously
    acknowledged their own concerns while behaving in ways that
    ensured those concerns would not be addressed: They filled
    18
    suspicious orders with expressed “reservations,” without
    notifying DEA. On occasions when Masters took a stab at
    investigating in response to a SOMS hold, it accepted, without
    seeking to verify, the half-baked or implausible explanations
    its customers supplied. We have considered each of Masters’
    challenges to the sufficiency of the evidence. Our review gives
    us no ground to disturb the Administrator’s carefully
    documented conclusions. See Cumberland Coal Res., LP, 717
    F.3d at 1028.
    III.
    Masters further contends that the Administrator’s decision
    effectively amended existing DEA rules in violation of the
    APA. When an agency creates rules on a blank slate, it
    generally has the option of choosing whether to establish new
    policies through notice-and-comment rulemaking or
    adjudication. See, e.g., POM Wonderful, LLC v. FTC, 
    777 F.3d 478
    , 497 (D.C. Cir. 2015) (“[T]he choice between rulemaking
    and adjudication lies in the first instance within the agency’s
    discretion.” (quoting Cassell v. FCC, 
    154 F.3d 478
    , 486 (D.C.
    Cir. 1988))). But Masters contends that, once an agency
    promulgates a rule following public notice and comment, it
    may not amend or repeal the rule in an administrative
    adjudication. See Pet’r Br. 49 (citing Marseilles Land & Water
    Co. v. FERC, 
    345 F.3d 916
    , 920 (D.C. Cir. 2003)). In Masters’
    view, the Administrator amended two notice-and-comment
    rules in adjudicating this case: 
    21 C.F.R. § 1301.74
    (b) (the
    regulation defining suspicious orders) and 
    21 C.F.R. § 1301.71
    (a) (the regulation defining effective controls against
    the diversion of controlled substances). We need not opine on
    DEA’s statutory authority to use an adjudication to modify a
    rule enacted through notice and comment because the
    Administrator neither created nor imposed any new duties. He
    relied on the existing Reporting Requirement.
    19
    A.
    As already noted, section 1301.74(b) defines
    “[s]uspicious” orders to “include orders of unusual size, orders
    deviating substantially from a normal pattern, and orders of
    unusual frequency.” 
    21 C.F.R. § 1301.74
    (b). According to
    Masters, the rule creates an exhaustive list of the characteristics
    that make an order for controlled substances suspicious, so that
    the Administrator could not treat an order as “suspicious” for
    any reason other than its size, pattern, or frequency without
    effectively expanding the rule. For example, the Administrator
    pointed to the fact that several pharmacies mostly sold
    controlled substances, rather than the mix of controlled and
    non-controlled medications typical for a bona fide retail
    pharmacy, as among the indicia that the pharmacy might be
    involved in illegal diversion. See, e.g, 80 Fed. Reg. at 55,484
    (Administrator explaining that orders placed by Tru-Valu
    pharmacy were suspicious, in part because 60 to 80 percent of
    Tru-Valu’s medication sales were for controlled substances);
    id. at 55,488 (Administrator explaining that orders placed by
    Englewood Specialty Pharmacy were suspicious, in part
    because “controlled substances prescriptions comprised nearly
    70 percent of all prescriptions the pharmacy dispensed”); id. at
    55,491-94 (Administrator explaining that orders placed by City
    View Pharmacy were suspicious, in part because “60 percent
    of the prescriptions filled by the pharmacy were for controlled
    substances”). The Administrator also concluded that several
    orders were suspicious because an unusually high percentage
    of the pharmacy’s customers paid for controlled substances
    with cash (the preferred payment method for illegitimate
    prescriptions), rather than traceable methods such as credit
    cards or health insurance. See id. at 55,488 (Administrator
    explaining that orders placed by The Drug Shoppe were
    suspicious, in part because “85 percent of the controlled
    substance prescriptions it filled were paid for with cash”); id.
    20
    at 55,484 (Administrator explaining that orders placed by Tru-
    Valu pharmacy were suspicious, in part because Tru-Valu did
    not accept insurance for all of its oxycodone products).
    Similarly, orders from pharmacies that bought oxycodone from
    Masters at a price higher than insurance would reimburse, but
    did not also sell enough other medications or products to offset
    such losses, raised suspicions that they sold oxycodone to the
    black market at a higher price. See id. at 55,494 (Administrator
    explaining that orders placed by City View Pharmacy were
    suspicious, in part because Masters’ staff had documented
    concerns about the pharmacy’s ability to “ma[k]e a profit”); id.
    at 55,497 (Administrator explaining that orders placed by
    Medical Plaza Pharmacy were suspicious, in part because it
    was not clear “how the pharmacy could be making a profit
    when insurance reimbursed at a lower rate ($32) than what
    Master[s] charged for oxycodone ($39)”).
    Contrary to Masters’ suggestion, the Administrator did not
    impermissibly amend section 1301.74(b) when it held that the
    rule does not exhaustively list characteristics that might make
    a retail pharmacy’s order for large quantities of controlled
    substances “suspicious.” See 80 Fed. Reg. at 55,473-74.
    Section 1301.74(b) defines suspicious orders as “includ[ing]”
    orders of an unusual size, pattern, or frequency, and it is well
    established that the word “include” often precedes a list of
    “illustrative” examples, rather than an exclusive list of indicia
    of an identified wrong. Fed. Land Bank of St. Paul v. Bismarck
    Lumber Co., 
    314 U.S. 95
    , 99-100 (1941); accord Alabama v.
    North Carolina, 
    560 U.S. 330
    , 340-41 (2010).                 The
    Administrator noted that Masters’ reading of section
    1301.74(b) “would have ill-served the CSA’s purpose of
    preventing the ‘illegal . . . distribution . . . possession and
    improper use of controlled substances’” by failing to require
    the reporting of an order so long as it was of typical size,
    pattern, or frequency, even if a supplier actually knew “that a
    21
    customer was ordering controlled substances from it for the
    purpose of diverting them.” 80 Fed. Reg. at 55,473 (quoting
    21 U.S.C. 801(2)). Reading section 1301.74(b)’s listed
    characteristics as exemplary rather than exhaustive, DEA
    reasonably concluded that other indicia may also raise
    suspicions about an order for controlled substances. That
    conclusion was entirely consistent with the text of the
    regulation, as well as agency precedent. See, e.g., Southwood,
    72 Fed. Reg. at 36,497, 36,501-02 (internet pharmacy’s orders
    were suspicious because the pharmacy was buying an unusual
    mix of controlled and non-controlled substances, dominated
    overwhelmingly by controlled substances, which was not
    consistent with what legitimate pharmacies typically ordered);
    id. at 36,501 (supplier should have reported pharmacy’s orders
    as suspicious after the supplier’s agent visited the pharmacy
    and saw signs relating to mail-order business tied to an internet
    pharmacy that mailed prescriptions out of state, suggesting that
    the pharmacy was “filling . . . illegitimate prescriptions”).
    B.
    Second, Masters argues that the Administrator
    impermissibly amended section 1301.71(a) without notice and
    comment.       That section imposes a general duty on
    pharmaceutical distributors to “provide effective controls . . .
    against [the] diversion” of controlled substances. 
    21 C.F.R. § 1301.71
    (a). The regulation requires the Administrator to
    “use the security requirements set forth in §§ 1301.72-1301.76
    as standards for the physical security controls and operating
    procedures necessary to prevent diversion.” Id. Thus, in
    Masters’ view, sections 1301.72 through 1301.76 set out the
    only standards the agency may use to measure the effectiveness
    of controls against diversion:
    22
    These specifically enumerated “physical security
    controls and operating procedures” do not require a
    distributor to perform due diligence on its customers;
    the only requirement is that distributors make a
    “good faith inquiry” to verify that a customer has a
    valid DEA and state registration. Id. § 1301.74(a).
    Distributors also have an obligation to identify and
    report to DEA “suspicious orders,” which “include
    orders of unusual size, orders deviating substantially
    from a normal pattern, and orders of unusual
    frequency.” Id. § 1301.74(b).
    Pet’r Br. 46. Masters insists that the Administrator unlawfully
    used this proceeding to create new legal obligations by
    expansively reading existing law.          Foremost, Masters
    complains that the Administrator elaborated on the Shipping
    Requirement. As noted above, the Shipping Requirement
    mandates that pharmaceutical companies exercise “due
    diligence” before shipping any suspicious order. 72 Fed. Reg.
    at 36,500.     DEA first articulated that requirement in
    Southwood, 72 Fed. Reg. at 36,501, and Masters claims that the
    Administrator expanded on it here. See 
    80 Fed. Reg. 55,476
    .
    First in Southwood and then in this case, Masters contends, the
    Administrator amended the regulatory scheme by tacking the
    Shipping Requirement onto the settled list of “security
    requirements” stated in sections 1301.72–1301.76.
    Notably, however, the Administrator’s holding rests on
    Masters’ violation of the Reporting Requirement, not the
    Shipping Requirement. The Administrator’s Decision and
    Order summarized his reasoning and “conclude[d] that
    [Masters] ha[d] not substantially complied with 21 CFR [§]
    1301.74(b)”—the Reporting Requirement. 80 Fed. Reg. at
    55,500-01.     Consequently, even if the Administrator
    expansively read the Shipping Requirement, that reading had
    23
    no effect on his ultimate decision, and so provides no basis for
    relief. See 
    5 U.S.C. § 706
    .
    Similarly, Masters insists that the Administrator used this
    proceeding to create a handful of highly specific security
    requirements that are unrelated to the Shipping Requirement.
    Specifically, Masters protests that the Administrator
    announced that
    [1] “[A] distributor must use the URs in evaluating
    whether a customer’s [ratio of controlled to non-
    controlled drug sales] is suspicious” (JA 555); [2]
    “[e]ven if the Agency’s regulations do not require a
    distributor to document the reason provided by a
    customer to justify a suspicious order, documenting
    that reason is still an essential part of maintaining
    effective controls . . .” (JA 563 n.21); . . . [3] “the
    distributor must conduct ‘additional investigation to
    determine whether [its customer is] filling legitimate
    prescriptions’” (JA 612) . . . ; and [4] “investigation
    [into a suspicious order] must dispel all red flags
    indicative that a customer is engaged in diversion
    . . .” (JA 613).
    Pet’r Br. 47-48.
    Contrary to Masters’ suggestion, however, none of those
    statements created new security requirements. Rather, the
    statements collectively explained what a distributor in Masters’
    position must do if, instead of immediately reporting to DEA
    all orders of an unusual size, frequency, or pattern, it chooses
    to use the SOMS—or an equivalent program—to seek to dispel
    the suspicion surrounding such orders and report only those
    that still appear suspicious after investigation. As we have
    emphasized throughout this opinion, it is not necessary for a
    distributor of controlled substances to investigate suspicious
    24
    orders if it reports them to DEA and declines to fill them. But
    if a distributor chooses to shoulder the burden of dispelling
    suspicion in the hopes of shipping any it finds to be non-
    suspicious, and the distributor uses something like the SOMS
    Protocol to guide its efforts, then the distributor must actually
    undertake the investigation. For example, when an employee
    uses the SOMS Protocol to confirm or dispel suspicion based
    on the amount of controlled medication the pharmacy is selling,
    the employee must request a “UR,” i.e., a document showing
    the pharmacy’s “actual dispensing[s] . . . of each drug.” 80
    Fed. Reg. at 55,420. Moreover, the investigating employee
    must “document” customers’ explanations for suspicious
    orders, so that he or she can verify those explanations and make
    sure they are consistent over time. Id. at 55,428 n.21.
    Additionally, if a customer’s explanation for its order is
    “inconsistent with other information the [investigator] has
    obtained about or from the customer, . . . the [investigator]
    must conduct ‘additional investigation to determine whether
    [its customer is] filling legitimate prescriptions.’” Id. at
    55,477. Finally, the investigation must dispel all of the “red
    flags” that gave rise to the suspicion that the customer was
    diverting controlled substances. Id. at 55, 478. The
    Administrator recognized that, if investigating employees fail
    to take such basic steps, the SOMS (or similar protocol) does
    not function as an effective tool for dispelling suspicion.
    IV.
    Next, Masters contends that the Administrator’s decision
    violates its rights under the 2009 Settlement Agreement with
    DEA. In that agreement, DEA released Masters from liability
    and agreed to refrain from filing new administrative claims
    against it based on conduct alleged in the agreement and the
    2008 Order to Show Cause, all of which occurred before April
    1, 2009. J.A. 898-99. DEA also committed to reviewing
    25
    Masters’ “diversion compliance program” (i.e., the SOMS)
    within the first 180 days that the Settlement Agreement was in
    effect to determine whether it satisfactorily guarded against
    diversion. Id. at 901-02. Masters contends that DEA reneged
    on both of those promises, so cannot now rely on Masters’ pre-
    April 2009 conduct or inadequacies in the SOMS to support its
    revocation of Masters’ certificate of registration.
    A.
    Masters asserts that it is being penalized for failing to
    report suspicious orders placed before April 1, 2009, in
    violation of the Settlement Agreement. See J.A. 899. As
    Masters notes, the Administrator repeatedly cited Masters’ pre-
    April 2009 interactions with customers. The Administrator,
    however, only referred to those interactions to demonstrate
    Masters’ knowledge of its customers’ suspicious business
    practices, which should have prompted Masters to be
    especially scrupulous in reporting suspicious orders placed by
    those customers after April 1, 2009. For example, the
    Administrator noted that, in September 2008, Englewood
    Specialty Pharmacy requested that Masters increase its
    oxycodone purchasing limit. 80 Fed. Reg. at 55,488. In
    making that request, Englewood’s staff told Masters that 30 per
    cent of the prescriptions it filled were for controlled
    substances—a figure belied by Englewood’s then-current
    utilization report showing that nearly 70 per cent of the
    prescriptions Englewood filled were for controlled
    medications. Id. Just two months later, in November 2008,
    Masters sent a consultant to visit Englewood, who reported that
    Englewood “appear[ed] to be doing a larger narcotic business
    than [it] admit[ed].” Id. at 55,488-89. In light of the strong
    evidence that Englewood had a history of lying to Masters to
    obtain narcotics, the Administrator concluded that Masters
    should have reported as suspicious Englewood’s unusually
    26
    large post-settlement-period orders for oxycodone. See id.
    That conclusion was entirely consistent with the Settlement
    Agreement. J.A. 903 (reserving DEA’s right to admit evidence
    of pre-settlement conduct “for proper evidentiary purposes” to
    establish Masters’ liability “for non-covered conduct”).
    B.
    Masters also claims that it detrimentally relied on DEA’s
    commitment to review the SOMS and inform Masters if it
    found either component of the SOMS (the Computer Program
    or the Compliance Protocol) to be inadequate. As noted above,
    DEA represented in the Settlement Agreement that, within 180
    days of the agreement’s April 1, 2009, effective date—i.e., by
    July 30, 2009—DEA would visit Masters’ “distribution center”
    and “conduct a review of the functionality of Master[s]’
    diversion compliance program” (the Compliance Review).
    J.A. 901-02. DEA further represented that, “[a]t the conclusion
    of the Compliance Review, DEA [would] conduct an exit
    interview with appropriate Masters representatives to provide
    DEA’s preliminary conclusions regarding the Compliance
    Review.” Id. at 902. Finally, DEA agreed that, if the
    Compliance Review was unsatisfactory, DEA would
    “provide[] written notice with specificity to Masters on or
    before 220 days from the [e]ffective [d]ate of [the Settlement
    Agreement].” Id.
    It is undisputed that the Compliance Review did not
    completely fulfill the parties’ expectations. “[B]ecause the
    new policies had been implemented on August 14, 2009, only
    four days before the Compliance Review, there was not enough
    time to determine if the policies were being properly
    implemented.” 80 Fed. Reg. at 55,425. DEA nonetheless
    conducted a Compliance Review on August 17 and 18, 2009.
    DEA’s Diversion Investigators provided Masters’ personnel
    27
    some training regarding distributors’ obligations under the
    Controlled Substances Act, discussed specific concerns about
    certain of Masters’ past practices and customers and warned
    Masters not to continue such dealings, and gave some
    additional guidance on how to detect illegitimate dispensing of
    controlled substances. Id. at 55,422-23. Masters, for its part,
    briefed the investigators on its drug handling policies and
    procedures, including its SOMS. Id. at 55,423-25. The SOMS
    had been put in place so recently that neither party could rely
    on the formal “exit interview” contemplated by the Settlement
    Agreement as assurance that the SOMS, as Masters actually
    operated it, brought the company into compliance with its
    obligations under the Controlled Substances Act. Id. at 55,425.
    Instead, what an investigator told Masters was that its written
    “policies and procedures” for the SOMS, “if properly
    implemented” by Masters’ personnel, “could promote an
    effective system to detect and prevent diversion of controlled
    substances.” Id.
    According to Masters, much of the conduct on which the
    Administrator relied in these proceedings should have been
    apparent to DEA investigators during the Compliance Review.
    Because Masters did not receive the written notice that DEA
    promised to provide if it found the Compliance Review to be
    “not satisfactory,” J.A. 902, and because of “DEA’s silence
    following the Compliance Review,” Masters says that it
    presumed that it was operating within the letter of the law.
    Pet’r Br. 53-59. Masters therefore asserts that it was deprived
    of a key benefit of the Settlement Agreement: an opportunity
    to correct any shortfalls in its controlled substances program
    before they triggered administrative action to revoke its
    certificate. Masters contends that DEA is contractually bound
    and equitably estopped from holding it responsible for any
    deficiencies in the SOMS of which the agency did not
    previously notify Masters in writing. See id. at 57-59.
    28
    As the Administrator noted, the Settlement Agreement
    provided no remedy for Masters in the event that DEA failed
    to provide written notice of any observed deficiencies in
    Masters’ SOMS; the key question is thus whether, in light of
    the Settlement, DEA should be equitably estopped from
    holding Masters to account for inadequacies in its diversion-
    detection policies and practices that, according to Masters,
    were reasonably observable in 2009 but not identified by DEA
    in the Compliance Review. See J.A. 564 (citing Dantran, Inc.,
    v. U.S. Dep’t of Labor, 
    171 F.3d 58
    , 66 (1st Cir. 1999) (holding
    that an agency was not equitably estopped from imposing
    liability on a party who relied on a “clean bill of health” from
    government investigators)).
    To estop the government, a regulated entity must show
    that: (1) the government made a “definite representation”; (2)
    on which the entity “relied . . . in such a manner as to change
    [its] position for the worse”; (3) the entity’s reliance was
    reasonable; and (4) “the government engaged in affirmative
    misconduct.” Morris Commc’ns, Inc. v. FCC, 
    566 F.3d 184
    ,
    191 (D.C. Cir. 2009) (quoting Graham v. SEC, 
    222 F.3d 994
    ,
    1007 (D.C. Cir. 2000)). In this case, assuming that the
    government made a “definite representation” to Masters that it
    would identify problems with the SOMS within 220 days of an
    inspection, see 80 Fed. Reg. at 55,425, Masters has
    demonstrated neither reasonable reliance on the statement nor
    affirmative government misconduct.
    There is no evidence of reliance on Masters’ part. If
    Masters had waited 220 days after the effective date of the
    Settlement Agreement to ensure that DEA had no quarrels with
    the SOMS, and then rigorously implemented the SOMS as a
    compliance strategy, Masters might be able to claim that it
    relied on DEA’s statement about “written notice.” But that is
    not what happened. Instead, following the Compliance
    29
    Review—at which Masters presented and promised to follow
    its brand-new SOMS—Masters’ employees consistently failed
    to implement the SOMS Protocol. Consequently, Masters
    cannot claim that it relied to its detriment on DEA’s review.
    Even if Masters had shown that it actually relied on the
    Administrator’s undertaking to provide written notice of any
    problems with the SOMS, there are several reasons why it
    would have been unreasonable to place great weight on such a
    promise. At the time of the Compliance Review, the SOMS
    was only three or four days old; consequently, Masters’
    employees had no track record to show how they were
    operating the SOMS in practice. The most DEA’s Diversion
    Investigators were in a position to do is comment on the
    adequacy of the SOMS Compliance Protocol on paper. Thus,
    Masters could not reasonably believe that DEA’s failure to
    provide written follow-up after the Compliance Review
    amounted to approval of the way that Masters’ employees were
    implementing—or failing to implement—the SOMS. In any
    event, the Settlement Agreement expressly cautioned Masters
    not to rely on the results of the Compliance Review, stating: “A
    finding of ‘satisfactory’ [after the Review] does not otherwise
    express DEA’s approval of Masters’ compliance program.”
    J.A. 902.
    And even if the DEA review addressed the SOMS in
    operation, and even if Masters had reason to and did rely on
    that review, there is no evidence suggesting that the
    government engaged in the “affirmative misconduct”
    necessary to sustain a claim of estoppel against the
    government. Morris Commc’ns, Inc., 
    566 F.3d at 191
    . The bar
    for establishing “affirmative misconduct” is high, requiring a
    showing of “misrepresentation or concealment, or, at least,
    behav[ior] . . . that . . . will cause an egregiously unfair result.”
    GAO v. Gen. Accounting Office Pers. Appeals Bd., 
    698 F.2d 30
    516, 526 (D.C. Cir. 1983). Generally, “ordinary negligence”
    does not qualify as egregiously unfair conduct. See Bowman v.
    D.C., 
    496 F. Supp. 2d 160
    , 164 (D.D.C. 2007). Nor does a
    simple failure to perform under a contract. See Morris
    Commc’ns, Inc., 
    566 F.3d at 191-92
     (government did not
    engage in “affirmative misconduct” when it promised to act on
    a waiver request in 30 days, but failed to do so for three years).
    Here, Masters has not identified any governmental misconduct,
    let alone extraordinary misconduct.
    V.
    Masters further contends that the Administrator’s decision
    violated the APA insofar as it was based on Masters’ refusal to
    accept responsibility for its alleged misconduct. Masters
    believes the Secretary decertified it for refusing to accept
    responsibility “before the hearing and before DEA had
    established its prima facie case.” Pet’r Br. 52. Such adverse
    action would be inconsistent with DEA rules that guarantee
    regulated parties an evidentiary hearing. 
    21 C.F.R. §§ 1301.41
    -
    46 (DEA hearing regulations). Thus, Masters concludes, the
    Administrator violated the provisions of the APA that require
    agency decisions to be “in accordance with law” and to follow
    the “procedure[s] required by law.” See 
    5 U.S.C. § 706
     (2)(a),
    (d).
    Contrary to Masters’ suggestion, the Administrator did not
    decertify Masters for putting DEA to its proof. As the
    Administrator recently explained, DEA has “never held”—in
    Masters’ case or any other—that “a respondent must admit to
    [its] misconduct prior to even being able to test the
    Government’s evidence at [a] hearing.” Hatem M. Ataya, M.D,
    
    81 Fed. Reg. 8,221
    , 8,224 (Drug Enf’t Admin. Feb. 18, 2016).
    Rather, under longstanding DEA precedent, once DEA
    presents enough evidence at a hearing to show that a registered
    31
    vendor or distributor of controlled substances has “committed
    acts inconsistent with the public interest,” the “registrant must
    present[] . . . mitigating evidence” including evidence that it
    has “accept[ed] responsibility for its actions and
    demonstrate[d] that it will not engage in future misconduct.”
    Medicine Shoppe—Jonesborough, 
    73 Fed. Reg. 364
    , 387
    (Drug Enf’t Admin. Jan. 2, 2008) (internal quotation marks
    omitted). In this case, the government came forward with
    ample evidence that Masters committed acts inconsistent with
    the public interest by failing to report suspicious orders.
    Masters presented no responsive evidence showing that it had
    recognized the consequences of its misconduct. In fact, before
    trial, Masters went so far as to stipulate that it did “not accept
    responsibility for any alleged wrongdoing.” J.A. 153.
    Furthermore, Masters’ refusal to admit fault played only a
    minor role in the Administrator’s decision to revoke Masters’
    certificate. The Administrator emphasized that, because
    Masters’ Compliance Protocol was “rarely, if ever followed,”
    Masters failed to investigate “hundreds of suspicious orders”
    for opioids. 80 Fed. Reg. at 55,501. That failure amounted to
    an “extensive and egregious” violation of DEA regulations. Id.
    The Administrator found that the “egregiousness” of the
    violation was “exacerbated” by the fact that Masters’ officials
    were “well aware of the oxycodone epidemic.” Id. Finally, the
    Administrator noted “the Agency’s interest in deterring future
    misconduct.” Id. In light of all those considerations, we
    conclude that, regardless of whether Masters accepted
    responsibility for its misconduct, the Administrator would have
    revoked its certificate of registration. Given the evidence of
    Masters’ failure to maintain effective controls against diversion
    of controlled substances and the absence of mitigating evidence
    of Masters’ acceptance of responsibility, the Administrator’s
    decision to revoke Masters’ certificate of registration was
    reasonable and supported by substantial evidence.
    32
    VI.
    Finally, Masters contends that the Administrator violated
    its due process rights by relying on arguments and evidence
    that were not presented during the administrative trial. The
    Due Process Clause gives regulated parties the right to fair
    notice of the arguments and evidence against them. NLRB v.
    Blake Constr. Co., 
    663 F.2d 272
    , 279 (D.C. Cir. 1981). An
    agency may not rely on evidence or arguments that were not
    discussed at a hearing as a basis for punishing a regulated party.
    See 
    id.
     Masters contends that the Administrator impermissibly
    did just that: He relied on arguments DEA had forfeited and
    evidence the ALJ had excluded as grounds to revoke Masters’
    certificate of registration.
    A.
    In particular, Masters claims that the Administrator relied
    on two points that DEA failed to preserve: (1) by April 1, 2009,
    Masters had gathered information that the seven Florida-based
    pharmacies listed in the 2013 OSC were potentially selling
    opioids illegally; and (2) certain orders placed by those
    pharmacies were suspicious because of their size, pattern, or
    frequency, rather than the characteristics of the pharmacy
    placing the order. Masters insists that those arguments were
    not presented to the ALJ or the Administrator, depriving
    Masters of any opportunity to refute them. Once again,
    Masters’ argument is belied by the record.
    Contrary to Masters’ suggestion, DEA never forfeited the
    argument that, by April 1, 2009, Masters was on notice that the
    seven pharmacies might be selling opioids illicitly. DEA
    argued pretrial that “pre-April, 2009 evidence [would] be
    offered [at trial] to show that Masters had knowledge of
    potential problems with certain customers.” Order Granting in
    Part Respondent’s Motion in Limine to Preclude Admission of
    33
    Irrelevant, Immaterial, and/or Incompetent Evidence and to
    Adopt Findings at 5, Masters Pharm., Inc., No. 13-39 (Feb. 7,
    2014), J.A. 161. The ALJ then ruled that DEA could use pre-
    April, 2009, evidence. Following that ruling, Masters admitted
    in evidence its 2008 business records. DEA witness James
    Rafalski then testified that, given the information in Masters’
    2008 records, Masters should have known that the Seven
    Pharmacies engaged in patterns of conduct suggesting that they
    might be involved in illicit opioid sales, including: telling
    Masters that it was dispensing a relatively low quantity of
    controlled substances during periods when utilization reports
    showed that it was in fact dispensing suspiciously high
    quantities of controlled substances; conducting a high
    percentage of its controlled substance sales with cash; and
    selling an unusually high ratio of controlled to non-controlled
    medications. For example, Diversion Investigator Rafalski
    provided written testimony that, in light of Masters’ 2008
    records for Englewood, Masters should have been cautious
    about any of Englewood’s orders for controlled substances.
    See J.A. 1151-54. As noted above, those records contain a
    report from a Masters investigator noting that Englewood’s
    pharmacist seemed to be lying about his controlled substance
    sales. Id. at 1153. In addition, Englewood’s utilization report
    dated September 22, 2008, “revealed that approximately 80%
    of all pharmaceuticals [it] dispensed were controlled
    substances.” Id. at 1154. According to Rafalski, Masters’ 2008
    files for other customers raised similar concerns, yet Masters
    paid no special attention to those customers’ orders for
    controlled medications. Thus, in its proposed findings of fact
    and conclusions of law, DEA argued that Masters’ customer
    files—which included the 2008 records—“revealed numerous
    red flags . . . that were regularly ignored.” Id. at 297. On this
    record, Masters cannot credibly claim that DEA forfeited its
    arguments based on pre-April 2009 evidence, or that it lacked
    fair notice that DEA would rely on that evidence. Cf. Katz v.
    34
    SEC, 
    647 F.3d 1156
    , 1161-62 (D.C. Cir. 2011) (regulated party
    had fair notice that the SEC would rely on “false account
    statements,” where an administrative hearing officer denied a
    motion to strike those statements and the statements were later
    introduced at the administrative trial).
    Masters makes a similarly unsupported assertion that
    “DEA never identified in its [2013 Order to Show Cause],
    prehearing statements, or written or oral testimony[,] a single
    order for controlled substances . . . that DEA deemed
    suspicious due to its unusual size, its deviation from a usual
    pattern, or its unusual frequency.” Pet’r Br. 31. “Likewise,”
    Masters protests, “DEA never alleged that every order held for
    review by [the Computer Program] was per se suspicious . . .
    unless Masters obtained and independently verified the reason
    for the order.” 
    Id.
     Masters accordingly objects to the
    Administrator’s reliance on Masters’ inadequate response to
    held orders.
    We are somewhat mystified by this argument. Before the
    administrative trial began, DEA provided Masters a copy of the
    written testimony of DEA Diversion Investigator Rafalski. In
    that testimony, Rafalski stated that, in his conversations with
    Masters’ staff, he learned that the SOMS computer program
    was designed to hold orders of an unusual size, pattern, or
    frequency. J.A. 1124. That testimony was confirmed by
    Masters’ policy manual, which states that the SOMS Computer
    Program was designed to hold “all orders for controlled drugs
    that meet or exceed the criteria set out in 21 C.F.R. [§]
    1301.74(b),” i.e., orders of unusual size, pattern, or frequency.
    Id. at 1436. Echoing that evidence, DEA’s proposed findings
    of fact and conclusions of law: (a) noted that the Computer
    Program held orders of an unusual “size, pattern, or
    frequency”; and (b) asserted that Masters’ failure to follow its
    own policies—including the policy requiring Masters to
    35
    “discern the reason for [an order’s] deviation in size, pattern,
    or frequency”—rendered Masters’ system for complying with
    DEA regulations ineffective. Id. at 296. Thus, Masters had
    ample opportunity to consider and rebut the proposition that
    orders held by the Computer System were orders of a
    suspicious size, pattern, or frequency, which Masters had a
    legal obligation to report or investigate.
    B.
    1.
    Masters also insists that the Administrator violated its due
    process rights by relying on excluded evidence. Specifically,
    Masters claims that the ALJ ordered the exclusion of
    “information Masters gathered” before April 1, 2009, but that
    the Administrator nonetheless relied on the excluded
    information in determining that Masters should have
    questioned orders placed by the Seven Pharmacies. Pet’r Br.
    at 27-29. Masters points to the Administrator’s reliance on
    information that Masters gathered in December 2008 to support
    his conclusion that Masters should have been suspicious of
    later orders placed by Tru-Valu, and similar reliance on
    information Masters gathered “prior to April 1, 2009” to
    support his conclusion that Masters should have suspected The
    Drug Shoppe, Englewood, City View, Superior, and
    Morrison’s. Id.
    The ALJ’s ruling specifically permitted DEA to rely on
    pre-April 1, 2009, information to “show that Masters had
    knowledge of potential problems with certain customers” that
    should have informed its later interactions with those
    customers; Masters’ contrary contention fails to acknowledge
    the role the ALJ reserved for evidence of Masters’ earlier
    exposure to certain pharmacies. J.A. 161. What the ALJ ruled
    off-limits was any administrative liability on Masters’ part for
    36
    alleged violations of DEA regulations before April 1, 2009.
    But the ALJ held that the Administrator could—and he did—
    introduce evidence of Masters’ long-held knowledge that
    certain pharmacies had been operating in ways strongly
    suggesting that they were diverting controlled substances,
    including its knowledge of operations reaching back before
    April 2009. Evidence of Masters’ pre-April 2009 experiences
    highlighted that Masters should have been particularly diligent
    in reviewing orders placed by certain known, rogue
    pharmacies.      That evidence permissibly bolstered the
    Administrator’s conclusions that, when Masters failed to
    investigate and report suspicious orders those same pharmacies
    placed after August 18, 2009, it violated the regulations. That
    use of pre-April 1, 2009, information was expressly permitted
    by the ALJ’s pretrial order.
    2.
    Masters further contends that the Administrator violated
    its due process rights by relying on evidence that the ALJ
    excluded regarding Masters’ misconduct between April 1,
    2009, and August 18, 2009. That was the post-settlement
    period when Masters was setting up its new compliance
    program and DEA was evaluating the program.               The
    Administrator determined that the ALJ should not have
    excluded that evidence; as he explained, “[n]othing in the
    [Settlement Agreement] provided [Masters] with immunity for
    potential violations [of the Controlled Substances Act] during
    [that time].” See 80 Fed. Reg. at 55,429 n.22. Consequently,
    the Administrator’s decision repeatedly refers to Masters’
    failure to report suspicious orders of controlled substances
    between April and August of 2009.
    On this point, we conclude that Masters’ claim of error is
    well founded. Even though the Administrator permissibly held
    37
    that the ALJ’s evidentiary ruling was wrong, the Administrator
    could not proceed to rely on the excluded evidence of Masters’
    misconduct during the post-settlement review period. Doing
    so would be in derogation of Masters’ right to respond to it.
    Because the ALJ had excluded the evidence, however, Masters
    had no need or opportunity during the administrative trial to
    exercise its right to respond.
    The Administrator’s error did not, however, rise to the
    level of a due process violation. Crucially, the Administrator
    recognized that reliance on that transition-period evidence
    might be impermissible. Id. at 55,501 n.198. He was thus
    careful to note that any discussion of that evidence was dicta:
    Even setting the disputed evidence aside, the Administrator
    explained, “the scope of [Masters’] failure to report suspicious
    orders following the [C]ompliance [R]eview [was] so
    extensive and egregious that I would come to the same
    conclusion that the revocation of [Masters’] registration is
    warranted to protect the public interest.” Id. Because the
    Administrator did not base his holding on the excluded
    evidence, Masters was not unlawfully deprived of its right to
    contest it. Cf. SEC v. Whittemore, 
    659 F.3d 1
    , 13 (D.C. Cir.
    2011) (erroneous admission of evidence did not violate
    “substantial rights” where the evidence “was not
    determinative” of the outcome).
    3.
    Masters contends that the Administrator also erred in
    considering other excluded evidence. As is relevant here, the
    ALJ’s pretrial order instructed the government not to rely on
    paragraphs 6 and 24 of DEA Diversion Investigator Kyle
    Wright’s declaration. Nevertheless, Masters asserts, the
    Administrator cited those paragraphs in his decision. Even if
    the Administrator erroneously cited the excluded paragraphs
    38
    from Investigator Wright’s testimony, both of those paragraphs
    address Masters’ alleged misconduct before August 2009. See
    J.A. 163. As discussed above, the Administrator’s decision
    was fully supported by evidence of Masters’ failure to report
    suspicious orders after that date. See 80 Fed. Reg. at 55,501
    n.198. Thus, for the reasons stated in the previous section, the
    Administrator’s mention of the excluded portions of
    Investigator Wright’s testimony was consistent with Masters’
    due process rights.
    ***
    Because Masters has not identified any prejudicial errors
    in the Administrator’s decision, we deny Masters’ petition for
    review.