Strict compliance with complex Drug Enforcement Administration regulations is a must for healthcare organizations that want to avoid fines, negative publicity, damaged reputation, and loss of licensure for personnel and entities. Understanding the regulations, however, can be challenging. 

In a previous article, we delved into some of the key DEA regulations your organization should be aware of and outlined recent settlements related to those regulations. The consequences for noncompliance are serious and costly. Understanding these findings can help your organization determine its risk exposure and where.  

Below are additional DEA regulations and settlements related to physical security controls, diversion reporting and monitoring, drug testing, and dispensing. We also provide compliance action plans for your organization to consider. Reviewing these findings is a great first step toward strengthening your organization’s overall DEA compliance program. 

Physical security controls, diversion reporting, and drug testing 

About the regulation: 

Title 21 CFR Part 1301.71 Security Requirements generally requires that all applicants and registrants provide effective controls and procedures to guard against theft and diversion of controlled substances. To determine whether a registrant has provided effective controls against diversion, the administrator shall use the security requirements set forth in §§1301.72-1301.76 as standards for the physical security controls and operating procedures necessary to prevent diversion.  

Recent DEA settlements: 

$4.36 million civil penalty—June 2022: “As part of the resolution, Sovah Health [Danville, Virginia] has committed to additional compliance measures including, but not limited to, having cameras at all Automated Dispensing Machines to capture the activity of placing/removing controlled substances; promptly reporting losses and diversion of controlled substances; taking and reporting disciplinary action taken against employees found to have been responsible for theft, diversion, or loss of controlled substances; maintaining a mandatory random drug testing program for employees; and conducting a full physical inventory of all federally scheduled II-V controlled substances more frequently than required by law.” 

$2 million civil penalty—June 2023: The DEA required Cheshire Medical Center in Keene, New Hampshire, to pay $2 million to resolve allegations that it violated the Controlled Substances Act by failing to keep accurate records of controlled substances, including opioids. The DEA began an investigation of CMC after a nurse stole 23 intravenous bags of fentanyl solution from an automatic medication dispensing machine. 

“This audit revealed an additional 17,961 missing controlled substance units and various related recordkeeping deficiencies on the part of CMC, such as failing to maintain accurate purchase and dispensation records. The audit also revealed that, among other things, CMC failed to regularly review reports to look for possible diversion, to have sufficient structures in place to alert it to the greatly increased purchasing of controlled substances from one month to the other, and to enforce various controlled substance security policies.” 

Your compliance action plan: 

• Establish a diversion response team that can rapidly and effectively respond to suspected incidents, with notifications tiered based on the stage of investigation. 
• Identify high-risk areas where controlled substance diversion could occur and implement specialized controls and more focused surveillance for these areas when warranted. 
• Conduct pre-employment background checks for healthcare workers who have access to controlled substances in the course of their job responsibilities. 
• Periodically audit human resources requirements for individuals authorized to handle controlled substances, including compliance with random drug testing requirements. 
• Report known diverters who are licensed or registered to the appropriate licensing or registration board as required by state law. 
• Create a comprehensive human resources and occupational health approach to support your organization’s controlled substances diversion prevention program that at a minimum consists of: 
• A written employee and provider substance abuse policy. 
• A healthcare worker education and awareness program. 
• Supervisor training program. 
• Employee and provider assistance program. 
• Peer support and systems, e.g., pharmacist recovery network. 
• Requirements for drug testing, including a for-cause policy for drug testing. 
• Return-to-work policies for healthcare workers. 
• Sanctions for performance and diversion violations. 

Criminal charges, diversion monitoring, and dispensing 

About the regulation: 

The DEA’s Pharmacist’s Manual (2022 edition) indicates every pharmacy must maintain complete and accurate records on a current basis for each controlled substance received, sold, delivered, or otherwise disposed of (21 CFR 1304.21(a)). These records are required to provide accountability of all controlled substances from the manufacturing process through the dispensing pharmacy and to the ultimate user. The closed system reduces the potential for diversion of controlled substances. 

The DEA’s Pharmacist’s Manual (2022 edition) also indicates that theft of controlled substances from a registrant is a criminal act and a source of diversion that requires notification to the DEA. A pharmacy must notify the local DEA Diversion Field Office in writing (Appendix K) within one business day of discovery of a theft or significant loss of a controlled substance (21 CFR 1301.76(b)). 

Although it is not specifically required by federal statute or regulations, the registrant also should notify local law enforcement and state regulatory agencies. Prompt notification to law enforcement agencies will allow them to investigate the incident and prosecute those responsible for the diversion. If there is a question as to whether a theft has occurred or a loss is significant, a registrant should err on the side of caution and report it to DEA and local law enforcement authorities.

 

Recent DEA settlements: 

Criminal conviction—March 2022: A former registered nurse working at Sovah Health in Danville, Virginia, was sentenced to 36 months in federal prison for tampering with consumer products (fentanyl and hydromorphone) and making false statements to law enforcement. Multiple vials of fentanyl had caps removed and evidence of cap replacement. The automated drug dispensing machine recorded user access to the drawer, and one RN was discovered to have documented access. After multiple interviews with DEA and state licensing boards, the RN admitted she had a substance abuse problem, self-medicated with opioids, and diverted the fentanyl and hydromorphone she accessed at Sovah Health for her own use. The RN pleaded guilty to one count of tampering with consumer products (fentanyl and hydromorphone) that affect interstate commerce, one count of reckless disregard for the risk that another person be placed in danger of death or bodily injury, and one count of making false statements. 

$250,000 civil penalty—June 2024: “Palomar Health, a California public health care district located in San Diego County, has paid $250,000 to resolve allegations of diversion of fentanyl from one of its facilities and failure to keep accurate records for fentanyl. … This settlement arises from a self-disclosure Palomar Health made to the DEA that one of its employees may have diverted controlled substances. The government investigated Palomar Health and concluded that vials of fentanyl were diverted from Pyxis machines—automated medication dispensing machines often used in hospital settings—located at Palomar Health’s Cardiac Catheterization Lab in Escondido. Specifically, the government concluded that over a five‑month period, numerous vials of fentanyl were diverted from the Pyxis machines and unused fentanyl was not properly disposed of.” 

Your compliance action plan: 

• Complete routine controlled substance inventory counts by staff, including an inspection of the vials/packaging. 
• Create procedures to document the transfer of controlled substances at shift changes. 
• Create a proactive monitoring program to identify outliers for controlled substance usage and discrepancies in administration to waste. 
• Conduct self-audits by individuals external to the area being audited.  
• Report known diverters who are licensed or registered to the appropriate licensing or registration board as required by state law. 
• Witness all controlled substance wastes and returns to stock, including vial inspection. 
• Conduct staff education regarding the responsibilities and obligations of: 
• Chain of custody for controlled substances. 
• Staff obtaining the controlled substance. 
• Documentation of waste.  
• Witness for wastes and returns. 
• Suspicious behavior, including signs and behavior patterns and symptoms of impairment. 

Need additional help with DEA compliance? 

These DEA regulations and settlements serve as an important reminder to healthcare provider organizations that noncompliance has serious consequences. Kodiak’s comprehensive pharmacy solutions combined with our expertise can help you navigate complex regulations, including identifying and closing your greatest risk gaps. 

For more information on DEA regulations or how Kodiak can assist you with implementing or maintaining your controlled substance diversion monitoring program, contact our compliance experts.