One Noncompliant Healthcare System Is Remediating its Controlled Substance Deficiencies

Hospitals and healthcare systems simply must comply with all federal Controlled Substances Act (“CSA”), Drug Enforcement Administration (“DEA”) regulations, and state requirements.  Controlled substances are critical to patient care but a myriad of required recordkeeping, reporting and security make hospitals and healthcare systems particularly vulnerable.  Failure to comply with controlled substance regulatory obligations can result in increased patient and employee health risks that include undertreatment, overdose and death; multimillion dollar settlements that have been increasing each year; significant long-term costs to comply with remedial settlement agreements; unwanted negative national and local publicity; and the erosion of public trust and confidence.

Over the years, numerous registrants have paid significant monetary penalties and entered into onerous settlement agreements to resolve allegations that failure to comply with their regulatory obligations allowed large-scale diversion of controlled substances by their own employees.

A recent high-profile DEA settlement involves a not-for-profit healthcare system that holds fifty-three DEA registrations at various locations.  Last month the U.S. Attorney’s Office for the Northern District of West Virginia announced that the healthcare system agreed to pay $4,177,139 and entered into a three-year Memorandum of Agreement (“MOA”) to resolve allegations that it violated multiple provisions of the CSA over seven years.

This post illustrates for healthcare systems in particular, and DEA registrants in general, what a DEA investigation disclosed at one system with multiple facilities and DEA registrations, and how through an MOA it is remediating its deficiencies.  Registrants should pay diligent attention to the MOA components and consider incorporating some of them into their own controlled substance compliance program.

DEA Investigation:

As with many investigations ending with civil settlements, DEA began investigating the healthcare system after learning that a nurse had stolen controlled substances from one of its facilities.  The DEA investigation disclosed that the system had identified numerous internal controlled substance thefts by employees that were not always reported.  An expert review report written at the system’s request identified multiple potential controlled substance diversion issues that leadership was aware of that were not implemented at all facilities.  Employees who were suspected of diverting controlled substances were not always interviewed.  The facilities did not consistently notify state licensing boards about employee thefts or suspected thefts.  Some facilities had hired individuals with controlled substance diversion histories.  Controlled substance prescriptions and prescription pads were pre-signed by practitioners.  Employees placed controlled substances in their pockets or took controlled substances to their homes.

Healthcare System Admissions:

While the healthcare system did not admit liability in the settlement agreement, it did admit that some DEA-222 Official Order Forms documenting the ordering, receipt, and distribution of schedule II controlled substances included errors, as did forms for schedule III-V drugs.  Policies and procedures were not fully consistent with the CSA and DEA regulations.  There were facilities that failed to maintain complete and accurate records of each controlled substance handled.  Individuals executed power of attorneys for individuals who lacked such authority.  One facility failed to conduct any biennial inventories and facilities failed to properly document controlled substance distributions to other registrants.

Memorandum of Agreement:

A.  In addition to the significant civil monetary fine, the healthcare system entered into a three year MOA designed to remediate its controlled substance regulatory deficiencies. Among its many provisions, the MOA requires the system to:

1. Abide by all federal, state, and local statutes and regulations relating to controlled substances.
2. Maintain complete, accurate and readily records.
3. Within 90 days create a DEA-compliant invoice template for schedule III through V controlled substances transfers between registered locations.
4. Agrees to maintain readily retrievable records at each of its registered locations in accordance with 21 U.S.C. § 827(b).
5. File reports, including theft and significant loss reports, within the required timeframe.

B.  Within 180 days of execution of the MOA the system will create and implement diversion response teams, that include:

1. A systemwide Diversion Coordinator for the duration of the MOA;
2. A Diversion Officer for each registered location;
3. A Diversion Response Team for each registered location and fully defined diversion response workflow systemwide;
4. Diversion Response Teams for each registered location that will develop an email group for communicating issues and concerns as they arise with the Systemwide Diversion Coordinator included on each diversion response team email group;
5. Develop a systemwide Diversion Oversight Committee that will include the Systemwide Diversion Coordinator and Diversion Officer from each registered location;
6. A post-case review process after each suspected diversion event and preparation of a written report of the findings; and
7. The Systemwide Diversion Coordinator providing a high-level summary of each suspected diversion event for which a DEA-106 is filed and for which a patient risk analysis form was executed to the full system board on a biannual basis.

C.  Within 120 days after execution of the MOA the system will implement a diversion policy that will include the following components:

1. Performing detailed drug diversion surveillance and auditing of clinical staff;
2. Conducting and reviewing reports;
3. Addressing diversion activity concerns;
4. A process identifying and monitoring staff with a prior history of controlled substance discrepancies;
5. A process regularly auditing controlled substance transactions;
6. Registered pharmacies not open 24-hours will review after-hours badge access quarterly; limiting after-hours controlled substance access to necessary persons; and
7. Each registered location maintaining a central “watch list” of employees for tracking and trending suspicious transactions outliers which will be provided to the Systemwide Diversion Coordinator.

D.  Within 180 days after execution of the MOA the system will:

1. Interview individuals suspected of diverting controlled substances; ask each individual how long they had diverted controlled substances and how they diverted; interview at the time of the drug screen and do not be defer to a later time;
2. Establish a database of employees who discharged and/or who resign due to diversion or suspected diversion;
3. Revoke privileges to automated dispensing machines immediately for employees who are suspended, voluntarily terminated, or involuntarily terminated;
4. If required by licensing authorities, notify within 15 days of any licensed employee discharged or who resigned due to diversion or mishandling of controlled substances; if the system creates a report, provide a copy to DEA within 15 days; and
5. Conduct comprehensive background checks on any new employee who will handle controlled substances to identify history of drug diversion; the background check will include a criminal background check, search by vendors of national criminal databases and search of relevant state licensing agencies to verify complaints or administrative action against a licensee.

• • The system shall report any confirmed theft to a law enforcement agency with jurisdiction over the location where the theft occurred within one business day of confirming the theft occurred; management will address incidents of suspected employee diversion by limiting or prohibiting access to controlled substances by employees believed to be involved in drug diversion.

E.  Within one year after execution of the MOA the system will institute a broad education program focusing on prevention of drug diversion in the workplace;

1. The initial and annual online or in-person education program for all employees will include the following criteria designed to prevent drug diversion and create awareness for handling of controlled substances and the proper ways to respond to diversion and reporting:

• • Risks of the potential of drug diversion in the workplace;
  • Signs and symptoms of addiction and diversion, threats to patient care, threats to life, impact on personal careers, and effect on public trust; the program must identify federal controlled substance laws and regulations, and identification and reporting of suspected drug abuse or diversion;
  • Witnessing waste of controlled substances, including references to professional implications and progressive discipline for falsifying witnessed waste;
  • Prohibition of pre-signing controlled substance prescriptions and the risks of leaving prescription pads in unsecured locations;
  • How prescribers access state prescription monitoring databases and check their profiles for unauthorized prescriptions;
  • How to identify and handle damaged or adulterated medications; and
  • For investigating suspected diversion, how to determine what information to collect and ensure proper chain of custody documentation.
    • The education program will completed by all employees who are authorized to handle or access controlled substances.
    • All individuals who complete the training will receive a certificate that grants access to controlled substances.
    • Consistent with applicable state law, the system agrees to:

1. Follow progressive discipline practices for employees violating controlled substance policies and procedures;
2. The system will restrict users’ access to automated dispensing machines to DEA-registered facilities where they are assigned to work;
3. Every six months each registered location will audit employee’s controlled substance access authority to ensure access remains is required for their duties; a facility will suspend or remove access to controlled substances for employee inactive for six months; facilities will ensure that employee’s access to automated dispensing machines are terminated when they leave employment.

F.  Within 180 days after execution of the MOA the system will implement the following to its systemwide diversion prevention program:

1. Systemwide pharmacy directors, pharmacists-in-charge, and those in pharmacy leadership positions at each registered location will be included in communications of all diversion-related events;
2. Systemwide nursing directors, nursing shift supervisors, and those in nursing leadership positions at each registered location will be included in communications regarding all diversion-related events;
3. Registered facilities will utilize diversion software tools and maintain records regarding
   suspected theft or significant loss of controlled substances for duration of the MOA;
   • Discrepancy resolutions identified by diversion software will be clearly identified for each issue and will include records, notes, and/or reports of interviews conducted; and
   • Information will be stored in Omnicell and/or ControlCheck or other commercially available substance control product;
4. The system will utilize Omnicell and/or ControlCheck or other commercially available substance control product to review and escalate the investigation of controlled substance events;
5. Registered locations will track within software systems circumstances behind all controlled substance administration after a patient is discharged; this tracking record will utilize discharge time vs. administration time;
6. Facilities will discourage handoffs of controlled substances except in emergency situations.
7. Ensure privileges to automated dispensing machines are immediately revoked for employees who are suspended, voluntarily terminated, or involuntarily terminated;
   • The systemwide diversion program will conduct site-rounding visits by the Systemwide Diversion Coordinator or a designated delegate to all registered facilities to ensure compliance with applicable state and federal regulations; rounding visits will be documented and made available upon request by DEA.
8. Each registered location will conduct a physical count of controlled substance inventory on a biennial basis, including all controlled substance locations like clinics and automated dispensing machines under the same DEA registration.

G.  Within 120 days after execution of MOA the system will implement a patient risk analysis form systemwide to be completed and documented in patient charts where there is reasonably confirmed diversion known to have impacted patient care.

H.  Beginning within three months of execution of the MOA, the system will install security cameras at pharmacy and controlled substance storage locations capable of recording controlled substance transactions; the system will spend $2,500,000.00 for installation at least 750 security cameras; recordings of all transactions will be maintained for three months and be available to DEA and law enforcement; in instances where identified diversion has occurred where security cameras are installed, the transaction recordings will be maintained for twenty-four months and be available to DEA and law enforcement.

I.  Beginning one year after execution of the MOA registered locations will conduct an annual audit to ensure compliance with the MOA with instances of non-compliance reported to DEA.

Final Word:

Hospitals and healthcare systems should heed what the DEA investigation disclosed, but especially what the MOA requires to correct the controlled substance deficiencies.  We suggest that registrants consider incorporating applicable components into their own controlled substance compliance programs.  Healthcare systems cannot afford not to.