Drug Diversion and the DEA: Lessons Learned

Originally published by our sister publication Pharmacy Practice News

What do Sovah Health in Abington, Va., UT Southwestern in Dallas, and Massachusetts General Hospital in Boston have in common? Each had multimillion-dollar fines levied against them by the Drug Enforcement Administration (DEA) for violating laws that regulate the safe handling of controlled substances (CS).

The claims against these health systems, made as recently as 2022, have a common theme: failure to prevent the diversion of prescription opioids and other CS. The cases also underscore that the DEA is not just going after community pharmacies, despite other high-profile actions against that class of trade.

“A pharmacy is a pharmacy is a pharmacy,” said Larry K. Houck, JD, a director at Hyman, Phelps & McNamara, P.C. All facilities that store and dispense CS need to be vigilant about ensuring their safe use, noted Mr. Houck, who has spent more than 35 years working first as a DEA diversion investigator and now as a lawyer specializing in litigation involving CS violations.

James Jorgenson, MS, RPh, the CEO of Visante, agreed that the DEA “is getting more aggressive with pharmacy enforcement in general, and any hospital that operates a retail/specialty operation needs to be ready on both the inpatient and outpatient fronts” to ensure DEA compliance.

The DEA’s aggressive pursuit of drug diversion is evident in its case against Sovah Health. The agency penalized Sovah for not recognizing that two employees repeatedly switched out fentanyl and hydromorphone injectables with saline to divert the active drugs for illicit use. In its settlement with the DEA, Sovah agreed to a very detailed list of compliance measures, including mandatory random drug testing for employees and full physical inventories of all Schedule II to V CS “more frequently than required by law,” a DEA press release stated.

The Cost of Noncompliance

“My understanding is that Sovah has to do the drug tests twice a year, and some of the other requirements that the DEA tends to put in these compliance agreements are not necessarily based on anything in the Code of Federal Regulations governing controlled substances; the sanctions may even be proposed by the organization,” said Maureen Burger, MSN, RN, CPHQ, FACHE, the chief nursing executive and a senior consultant at Visante. “But know this: If you agree to the terms of compliance, they definitely are binding—and it could be quite onerous, in terms of cost and staff time.”

A better strategy would be to proactively examine how your health system currently handles CS and to what extent it’s susceptible to drug diversion, Ms. Burger noted. That way, you’re more likely to prevent diversion and keep the DEA inspectors away from your door.

One good place to start is to examine whether there is a disconnect in how CS are handled by your inpatient and outpatient pharmacies, according to Greg Burger, MS, RPh, a managing director at Visante. “When you look at the detailed steps most acute care inpatient hospitals take to secure their controlled substances, and then see all of the loose practices in that same hospital’s on-site ambulatory pharmacy, the difference can be pretty striking,” he said.

Mr. Burger noted, for example, that the hospital pharmacy may have perpetual inventories and do daily counts for CS, “and yet the retail pharmacy may do only counts on Schedule II controlled substances once a month, and Schedule III to V once a quarter. It’s on the same campus and yet they’ve got different standards of practice.” The danger “is that a lot of diversion can happen over the course of those three months.”

Secondary software programs in the retail pharmacy are another potential point of failure because they often don’t include the anti-diversion features of health systems’ primary systems. “How do those secondary programs interact with your wholesaler when it comes to tracking controlled substances; do you have to manually enter inventory quantities? We find a lot of bad CS tracking practices in these embedded retail pharmacies,” Mr. Burger said. “Thankfully, that’s beginning to change now that a lot more hospitals are going with Epic’s retail module.”

Lack of security is another point of vulnerability in ambulatory pharmacies, he noted. Whether it’s too few closed-circuit cameras, or cameras that are not properly focused on will-call bins and other diversion-prone areas of the pharmacy, “these are oversights that really can prove costly,” Mr. Burger said.

In addition, it’s not just the point of dispensing that needs to be tracked. When filled prescriptions are sitting in the will-call stand to be picked up by patients, “the chances for drug diversion are very high,” he said. “Your staff may consider that controlled substance to be out of inventory and thus not worth their attention. But the reality is that it’s still within their store and they haven’t given it to the patient. So, it’s still very much your responsibility.”

During site visits, “we’ve seen cases where a patient came to pick up their prescription for opioids or some other controlled substance and they don’t have the correct quantity because somebody in the pharmacy has been helping themselves to the drugs,” Mr. Burger said. “Why? Because that prescription has just been sitting on open unsecured shelves or bins without good camera surveillance.”

Inventory Red Flags

But what if will-call prescriptions are never picked up and have to be returned to inventory? That is yet another opportunity for ambulatory pharmacies to run afoul of DEA regulations, Ms. Burger noted. “You have to have iron-clad documentation on that return,” she said. “You just can’t put it back on the shelf. The DEA’s sole goal with controlled substances is to have a 100% closed-loop system, where you have to track and document every single CS formulation. If you’re not doing that, then that’s on you when the DEA comes calling.”

This chance for diversion is not a theoretical risk or vulnerability, Ms. Burger stressed. “We recently learned of an organization that had a major drug diversion event happen in its community pharmacy and they weren’t keeping track of anything.” When the first signs of diversion emerged and the pharmacy started looking back at their records, “they quickly realized they had no system of controls in place, or they thought they did but they weren’t really following through on them.”

In fact, inadequate documentation is one of the most frequent CS points of failure for both inpatient and outpatient pharmacies, Ms. Burger noted. DEA regulations require that a health system’s documentation of Schedule II drugs be segregated from Schedule III to V medications. “You choose how to manage that—different binders, electronic folders, etc.,” she said. “But whatever system you choose, if the DEA comes to inspect your facility, you’ve got about two hours to produce requested documents and demonstrate you’ve adequately segregated those records. If you don’t have a system in place, you likely won’t hit that window and you will be at risk for getting cited.”

When pharmacies do a gap analysis of their CS practices, a question that may come up is whether to bring in outside sources to help. “We always encourage people to try and figure out as much as they can by themselves, and then have us come in,” Mr. Burger said. “At the end of the day, it’s all about helping the organization see what they don’t see because they’re enmeshed in their own processes and procedures every day, and it becomes the norm—right or wrong.”

Prescription Red Flags

Another often overlooked area that can trip up pharmacies is the DEA requirement that staffers flag suspicious opioid and other CS prescriptions before dispensing them. This was the focus of a presentation Mr. Houck made at APhA23, in Phoenix. He cited a high-profile case against Gulf Med Pharmacy, one of the top 10 opioid purchasers in Florida, to illustrate the consequences of noncompliance. The DEA found that Gulf Med repeatedly filling opioid prescriptions that exhibited “obvious red flags of abuse or diversion without documenting its resolution of those red flags,” the agency stated in a case summary. As for what those red flags were, Mr. Houck cited several, but emphasized that one of the most dangerous to miss is the repeated dispensing of “cocktail medications”—that is, CS combinations that significantly increase a patient’s risk for death or overdose.

In Gulf Med’s case, the pharmacy repeatedly dispensed high doses of opioids (hydromorphone, oxycodone and extended-release morphine sulfate) and depressants such as benzodiazepines (e.g., alprazolam, clonazepam or diazepam) or muscle relaxants (e.g., carisoprodol). This combination, often referred to as the Trinity cocktail, “is incredibly dangerous when consumed together, because both [drug classes] depress the central nervous system and can lead to respiratory failure,” Mr. Houck said. “DEA’s position is that there really is no rational medical indication for it. Gulf Med clearly should have questioned these combination prescriptions.”

Regardless of the specific offending prescription, vigilance is needed, Mr. Houck stressed. “Anyone involved in the handling of controlled substances needs to review their policies and procedures for recognizing suspicious prescriptions and then intervening when appropriate.”

The sources reported no relevant financial disclosures beyond their stated employment.