Common Regulatory Deficiencies of Hospital Employee Diversion

The Controlled Substances Act (“CSA”) and Drug Enforcement Administration (“DEA”) regulations mandate legitimate handlers of controlled substances to obtain a DEA registration, create and maintain certain controlled substance records and reports, and implement effective security to guard against diversion.  The underlying purpose of those requirements is to ensure controlled substance accountability by registrants.

High profile, large-scale hospital and healthcare system employee diversion has been a recent theme in our FDA Law Blog posts (here and here).  A number of common deficiencies were present in most or all of those cases.  And while the cases involve hospital and healthcare diversion, the deficiencies are also found in employee diversion from pharmacies, physicians, dentists and veterinarians.  The common deficiencies for employee hospital diversion cases include:

• The failure to maintain on a current basis complete and accurate controlled substance records for two years in violation of 21 C.F.R. §§ 1304.21(a) and 1304.04(a);
• The failure to conduct a full physical inventory at least once every two years in violation of 21 C.F.R. § 1304.11(c);
• Deficient recordkeeping contributing to the failure to monitor, detect and report employee diversion;
• The failure to report thefts and significant losses to DEA (and the states) in writing within one business day of discovery followed by a DEA Form 106 in violation of 21 C.F.R. § 1301.76(b), impeding timely investigation;
• The failure to adhere to internal controlled substance policies and procedures already in place;
• The lack of effective oversight by management of employees with controlled substance responsibilities and access;
• Inadequate and ineffective controls and procedures to guard against theft and diversion in violation of 21 C.F.R. § 1301.71(a);
• The ability to divert fentanyl undetected from vials, replacing it with saline later administered to patients; and
• Heightened vulnerability of automated dispensing machines.

These common deficiencies in employee diversion cases emphasize the importance of each regulatory requirement in every registrant’s ability to account for the controlled substances they import, manufacture, distribute, dispense, and export.