The U.S. Department of Justice (DOJ) recently announced a $2.3 million settlement with a hospital in Massachusetts (Hospital) to resolve allegations of Hospital’s failure to provide controls and safeguards against controlled substance diversion in violation of the Controlled Substances Act (CSA). According to the DOJ’s press release, this is the largest settlement related to drug diversion in a hospital.

Alleged Violations

In 2013, Hospital disclosed to the U.S. Drug Enforcement Administration (DEA) that one nurse had stolen approximately 14,492 pills and another nurse had stolen approximately 1,429 pills from automated drug-dispensing machines (ADMs). The majority of these pills were oxycodone. The settlement alleges that Hospital failed to timely notify the DEA of these thefts and failed to provide effective controls and procedures to guard against theft of controlled substances, both of which are in violation of the CSA. The DEA alleges that these failings led to the actual theft and diversion of controlled substances.

In addition to the conduct of the two above-mentioned nurses, the DEA identified several other major concerns, including several in the inpatient and outpatient pharmacies. In the DEA’s audit for controlled substances, it found discrepancies of 16,681 missing or extra pills in the inpatient pharmacy and 7,177 in the outpatient pharmacy. There were also many deficiencies with the ADMs, some of which were housed in Hospital’s pharmacies. The inpatient pharmacy staff was not alerted to medication overrides in ADMs. Additionally, physicians who had not been affiliated with Hospital for several months were still listed as users by the ADMs. At the DEA’s request, Hospital’s pharmacy also maintained a pharmacy information system (PIS) to generate ADM data, but the PIS data did not match the ADM data. Further, the hospital failed to properly use DEA Form 222 in 358 instances.

Several concerns appear to have arisen from lack of controls and failure to discipline healthcare professionals when appropriate. Some examples follow:

• An inpatient pharmacy manager reported that twenty syringes of morphine were missing from a pharmacy vault during unit moves, but no further action was taken.
• Two certified nurse anesthetists lost controlled substances several times and were not disciplined.
• Anesthesia residents signed out controlled substances for cases they would need later. Before the cases, they would take them off-campus. The residents were not disciplined for this practice.
• On a particular day, three syringes of controlled substances were found in operating rooms. There was no indication of who should have had them or where they came from.
• Medical personnel took controlled substances to the hospital cafeteria during lunch for the sake of convenience.
• An emergency room nurse was unable to explain 34 drug discrepancies except that they were caused by the fast pace of the emergency room and lack of documentation.

Settlement Agreement

The settlement required Hospital to pay $2.3 million to the U.S., as well as participate in a three-year Corrective Action Plan (CAP). Under the CAP, Hospital is required to take several actions to reduce the risk of potential drug diversion and theft in the future, including requiring Hospital’s ADMs to use biometrics to authenticate users and mandating that users reset passwords every 90 days, hiring outside auditors to engage in unannounced audits, reporting findings to the DEA and creating a Drug Diversion Compliance Officer position and multi-disciplinary Drug Diversion Team.

Further, the CAP provides that only pharmacists, or directly supervised pharmacy technicians, will have access to the pharmacy vault. Similarly, only authorized pharmacy employees or IT employees will have access to the ADM server. The Department of Pharmacy will have new roles and responsibilities, including conducting daily reviews of ADM reports and operating room post-case reconciliation. In these reviews, pharmacy staff must look for any overuse or misuse of controlled substances, resolve any discrepancies with missing or incomplete reports, and report discrepancies to the new Drug Diversion Compliance Officer within 72 hours. The Pharmacist in Charge will also have new duties, including signing off on the external auditor’s report with their unannounced audits and conducting a self-evaluation of its facilities to review compliance with the CSA.

Best Practices

Pharmacists should consider the restrictions and provisions in the CAP as CSA best practices. CAPs in drug diversion cases are becoming more common and will likely be more stringent in the future. Pharmacies, both retail and institutional, may want to consider the following aspects of the CAP in devising their own drug diversion compliance controls, depending upon the setting, size and complexity of the business:

• Create a drug diversion team and/or a drug diversion compliance officer position.
• Perform annual mandatory training for all employees who handle controlled substances.
• Train pharmacists on conducting self-evaluations for compliance with the CSA.
• Improve controls surrounding controlled substances, including ADMs, drug carts.
• Use biometrics to authenticate users on ADMs and require users to change their passwords at regular intervals.
• Purchase and implement controlled substance surveillance software.
• Restrict access to controlled substances to only necessary parties in appropriate locations and for appropriate reasons.
• Audit to ensure records are being maintained and submitted to the DEA and/or other appropriate government agencies as required by law.
• Discipline individuals who violate the CSA and internal policies governing controlled substances.

-Susan Bizzell, JD-MHA, is an attorney with Hall Render Killian Health & Lyman in Indianapolis, Indiana. This article was initially published in Indiana Pharmacist Alliance, is educational in nature and is not intended as legal advice.