Avoid Diversion Practices that Prompt DEA Investigations

January 2016 - Vol.13 No. 1 - Page #10
Category: Automated Dispensing Cabinets Monitoring Software
On September 28, 2015, Massachusetts General Hospital (MGH) entered into a settlement agreement with the United States government, conceding to pay $2.3 million to resolve allegations that between October 2011 and April 2015 MGH failed to take appropriate measures to prevent diversion within its walls. Specifically, the settlement states that MGH “failed to make, keep, or furnish certain records required to be kept under the (Controlled Substances) Act and failed to provide effective controls and procedures to guard against theft and loss of controlled substances.”1 In addition to the hefty monetary settlement, MGH agreed to implement a comprehensive corrective action plan to identify, prevent, and address future diversion.

The detailed settlement agreement2 provides a rare opportunity for health care facilities to gain insight into the Drug Enforcement Agency’s expectations (see TABLE 1), which apply universally to health care facilities. Institutions would be remiss to regard the settlement as simply the result of one health system’s unique issues; rather, much can be learned from the challenges encountered at MGH in establishing measures to prevent diversion in health care organizations across the country.

There is no doubt that every health care facility requires a comprehensive diversion detection program. (For more information, see Develop a Drug Diversion Prevention Program in the June 2015 issue of Pharmacy Purchasing & Products.) Essential components of such a program include the establishment of a diversion specialist position, a diversion response team, and a diversion oversight committee. Having a program in place facilitates the identification of risks, gives authority to the appropriate individuals to adapt processes as necessary, and may reduce the likelihood of a DEA inspection.

Accountability and Recordkeeping

Common themes that emerge in DEA audits and investigations are a lack of accountability and insufficient recordkeeping. It is essential that registrants keep accurate, up-to-date records of all controlled substances received, sold, delivered, and disposed; registrants must be able to quantify their inventory at any time. This is required by the Controlled Substances Act,3 the Medicare Conditions of Participation for Hospitals,4 and most, if not all, state boards of pharmacy. Specific recordkeeping concerns include:

Ensuring Accurate Inventory of All Scheduled Drugs. Conduct an initial inventory when a new DEA registration is received and biennially thereafter. Include an estimate of CIII-IV stock (in most circumstances) and a physical count of CIIs, including those in automated dispensing cabinets (ADCs) and any stock awaiting reverse distribution. Inventory newly scheduled drugs and re-inventory any rescheduled drugs (eg, hydrocodone was rescheduled in October 2014). Keep records of CII inventories separate from those of CIII-IV. Inventory records must be readily retrievable for at least 2 years.

Hospitals can help ensure the accuracy of their records by performing regular controlled substance inventories in the pharmacy, in clinical areas, and at all remote locations. If institutional policy requires that inventories be conducted at specified times, it is essential that those inventories are executed and that documentation of the results is created and maintained for each event.

Resolving Inventory Discrepancies in a Timely Manner. Review discrepancies across the facility on a daily basis. Task nursing with conducting weekly inventories of CII stock in their clinical areas, as this can help ensure prompt identification and resolution of discrepancies that otherwise might not be discovered in a timely fashion. It is critical that identified discrepancies be resolved without delay; fully investigate those discrepancies that cannot be resolved within 24 hours.

Staff members who are repeatedly involved in discrepancies first should be coached and then receive progressive discipline if their performance does not improve. Remind all staff with access to controlled substances of the DEA’s strict requirements. Inaccuracies, no matter how minor, may be viewed as evidence of a system-wide problem.

The perioperative environment is an area of particular concern. Reconcile anesthesia records on a daily basis. According to the MGH settlement, discrepancies must be resolved within 72 hours. Document all anesthesia discrepancies, regardless of their cause or method of resolution. In addition, monitor records for trends involving specific providers and specific drugs. Just as with other staff, counsel anesthesia providers and provide progressive discipline for continued discrepancies, even if these inconsistencies are due to a failure to document.

Completing DEA Form 222. Ensure that DEA Form 222 and invoices are legible, accurate, and complete for any controlled drugs that are transferred or sold. The forms must be signed and dated by a person authorized to sign a registration application or a person with properly executed power of attorney (if power of attorney signatures are permitted in your state). Upon receipt of controlled substances, the number of packages and the date must be recorded. DEA 222 Forms must be kept separate from other pharmacy business records.

Monitoring and Educating Staff

Staff who access controlled substances as part of their job should be monitored continuously to ensure appropriate medication handling, as it is not uncommon for staff members to become complacent when conducting rote tasks. Signs of complacency may include medications found unsecured or reports of staff accidentally taking medications home in their pockets. Regular, unannounced rounding, observation of processes, and a high level of interaction can help reduce such complacency. Rounds, in particular, are essential for identifying practice drift, workarounds, and a culture of noncompliance.

It is important to differentiate between noncompliance and diversion. Even when all possible precautions have been taken, diversion can still occur. Common diversion methods include:

Removing Medication for a Discharged Patient. Diversion schemes often involve removing medication for a patient shortly after the patient has been discharged; this practice is particularly common in the emergency department and in outpatient procedural areas. To reduce such opportunities, discontinue patient profiles as soon as possible after discharge. The MGH settlement indicates that allowing a profile to remain active up to 72 hours after discharge is too long. Ideally, patient profiles should be removed from the system within one hour of discharge, but if this is too lofty a goal, aim to remove patient profiles as soon as possible after discharge so that transactions to discharged patients will be flagged appropriately.

Using a Colleague’s ADC Sign-On. Another common diversion tactic involves removing a drug using a colleague’s password. Educate staff regularly on the importance of logging out of the ADC each time they complete a transaction and any time they step away from an ADC during a transaction. In addition, establish the shortest possible interval for the cabinet’s time-out setting. In the MGH settlement, the DEA was critical of a 2 minute time-out. Thirty seconds is ideal, provided such a short interval does not negatively impact workflow. Consider that procedural areas may require a different time-out setting than the general clinical units.

Overusing the ADC Override Function. ADC overrides can facilitate diversion, and, thus, should occur infrequently and be reviewed on a daily basis. Ensure that only drugs that are needed on an emergent basis are eligible for override removal. Keep non-profiled areas to a minimum.

Cancelling Transactions. Cancelled transactions, particularly repeated ones for a particular drug, may be an indicator of diversion by substitution and tampering, so monitor and review these transactions for trends. Because of the patient safety risks associated with tampering and substitution, the threshold for investigating patterns of cancelled transactions should be low.

Accessing ADCs After Employment Has Ceased. Strictly limit access to controlled drugs. When staff voluntarily or involuntarily end their employment, terminate their access immediately. This also must occur when staff change their role within an institution. For example, a pharmacy technician who becomes a nurse should have access to the pharmacy and its systems discontinued upon assuming the new role. Although many facilities remember to do this upon involuntary termination, discontinuation of system access often is delayed or inconsistent with voluntary terminations and role changes.

To prevent diversion in all its forms, it is vital that the facility’s policies and procedures detail:

  • Types of drug transactions and analytics reports that should trigger an automatic review
  • Frequency of reviews
  • Staff member responsible for conducting reviews
  • Length of time allowed to conduct a review
  • Procedures to be taken when particular thresholds are met
  • Documentation requirements

When nurse managers are responsible for reviewing reports, they must receive training at hire and regularly thereafter on the proper review processes. Assess the reports to ensure that they are user-friendly and straightforward. Ongoing monitoring is necessary to ensure that reports are reviewed as expected and that any instances of noncompliance are properly escalated.

DEA settlements with health care facilities almost universally require facilities to conduct annual staff education programs. In practice, facilities would be well served to go beyond regular education and address the overall culture by ensuring that staff members understand the risks created by diversion, feel individually responsible for reporting suspicions, and are familiar with the reporting process. Effective education reinforces that diversion is a real issue, that the potential exists for diversion to occur at every facility, and that diversion poses a substantial risk to patients and coworkers.

Once Diversion Is Confirmed

Some facilities struggle with reporting requirements and deadlines once diversion is confirmed. When diversion is handled with secrecy, pharmacy staff may not even be aware that diversion occurred. Every facility must have a defined reporting process, and the director of pharmacy must be notified in every case. Diversion is theft, so registrants are required to notify the DEA within 1 business day of discovery via DEA Form 106. The DEA field office also must be notified, preferably in writing. In the case of an ongoing investigation, update the DEA at regular intervals until the investigation is complete. Reporting is an essential part of the response. Without proper reporting, diverters may move from institution to institution, continuing to harm themselves, their patients, and the community.


Annual audits help identify areas that are vulnerable to diversion. Typically performed by external auditing firms, DEA regulatory experts, or pharmacy consultants, external auditing is especially helpful in the pharmacy, a department that commonly performs its own monitoring. Many facilities engage auditors to assess survey readiness and other areas of concern. While large diversion schemes have been uncovered as an incidental finding in a comprehensive external audit, more commonly, external audits help facilities identify unknown risks, troubleshoot problematic areas, and fine-tune processes. Given the complexity of diversion and the considerable risk to the hospital, regular auditing is a critical tool for ensuring DEA regulatory compliance.

Learning from Others

Much can be learned from the experience of others, as the mistakes of one institution rarely are unique. Taking the time to read others’ corrective action plans and explore one’s own facility for similar weaknesses can help avert DEA investigations, and perhaps more importantly, preclude harm to patients, thus preserving the safety of staff and patients alike. 

Kimberly New, BSN, RN, JD, is a specialist in controlled substance security and DEA regulatory compliance, and consults with health care facilities across the country. She works with health systems to establish and expand diversion detection programs with the overriding goal of improving patient safety.


  1. The United States Attorney’s Office: District of Massachusetts. MGH to Pay $2.3 Million to Resolve Drug Diversion Allegations. http://www.justice.gov/usao-ma/pr/mgh-pay-23-million-resolve-drug-diversion-allegations. September 28, 2015. Accessed November 11, 2015.
  2. Massachusetts General Hospital Settlement Agreement. http://www.justice.gov/usao-ma/file/778651/download. Accessed November 11, 2015.
  3. 21 USC §801 et seq.
  4. 42 C.F.R. §482 et seq.


Key Points in the DEA’s Corrective
Action Plan for MGH


  • Employ a full-time diversion specialist
  • Form a drug diversion team that includes a diversion specialist and representation from compliance, pharmacy, nursing, and security

Staff Training

  • Provide annual training for all staff who access controlled substances.
    Include such topics as signs and symptoms of abuse and addiction, drug diversion monitoring and prevention, duty to report, and filing incident/safety reports

Software and Technology

  • Implement user-friendly controlled substance surveillance software that indicates potential drug diversion
  • Utilize biometrics on all ADCs, reset passwords every 90 days, and place ADCs in all ORs
  • Restrict access to the controlled substances vault to pharmacists and directly
    supervise nationally certified pharmacy technicians
  • Allow only authorized pharmacy or IT employees access to ADC servers

Data Reconciliation


  • Review ADC reports daily, paying particular attention to large quantity dispenses, restock verification, null transactions, medication overrides, and discrepancies
  • Reconcile daily post-case anesthesia records and resolve discrepancies within 72 hours (or refer to the diversion specialist)


  • The nurse manager on each clinical unit must conduct a daily review of controlled substance transactions (Monday-Friday) and a weekly review of anomalous usage
  • Nursing supervisors review large quantity dispenses on weekends and holidays
  • Supervisors of nurse managers conduct monthly compliance checks to ensure managers are reviewing required reports

Drug Diversion Team

  • Review trend reports quarterly


  • Conduct physical counts, including counts at all ADCs, for all biennial inventory
  • External auditors conduct unannounced audits at all DEA registration sites
    (ADC and pharmacy CII-V): 100% of registration sites should be audited within the first 12 months, 50% during the second year, and 25% in the last year
  • Conduct an annual self-evaluation, signed by the director of pharmacy, which documents any corrective action to be taken


  • Promptly investigate and report all potential diversion/loss
  • Report to DEA if a diversion team member becomes aware that an employee was arrested or charged with a crime relating to diversion of controlled substances


  • Maintain ADC data for 2 years
  • Maintain disciplinary reports and implement a written policy of progressive discipline applicable to all employees with access to controlled substances


Like what you've read? Please log in or create a free account to enjoy more of what www.pppmag.com has to offer.

Current Issue