Hospitals: Do You Know Where Your Controlled Substances Are?

Employee diversion of controlled substances from hospitals has been an issue since at least 1986 when I became a diversion investigator with the Drug Enforcement Administration (“DEA”).  But there has been a recent string of large civil monetary settlements, some in the millions of dollars, to resolve allegations that hospitals’ non-compliance with the federal Controlled Substances Act (“CSA”) and DEA regulations allowed employees to divert staggering quantities of controlled substances.  These recent monetary settlements and diverted quantities are eye-opening; in some instances they are staggering.  It is unclear whether such large employee diversion has always occurred but was unreported or if there has been an actual dramatic increase of large incidents.

Numerous recent examples of large monetary settlements and significant controlled substance doses illustrating the following:

• Press Release– DEA investigated the University of Michigan Health System (“UMHS”) after a nurse and an anesthesiology resident overdosed, the nurse fatally. DEA alleged that UMHS failed to maintain complete and accurate records and failed to timely notify DEA of controlled substance thefts.  DEA concluded that UMHS’ deficient recordkeeping impacted its ability to guard against theft and diversion.  UMHS agreed to resolve the allegations in August 2018 for $4,300,000 and compliance with a three-year Memorandum of Agreement (“MOA”).
• Press Release– DEA alleged that McLaren Health Care Corporation (“MHCC”), also in Michigan, dispensed schedule II drugs without prescriptions despite red flags, violated recordkeeping requirements, and failed to timely report employee thefts to DEA. In January 2021, MHCC agreed to pay $7,750,000 and comply with a comprehensive three-year MOA.
• Press Release– Sovah Health (“Sovah”), a hospital system in Virginia, agreed to pay $4,360,000 and entered into a Non-Prosecution Agreement in June 2022 after a pharmacy tech diverted more than 11,000 schedule II doses and another 1,900 schedule III-V doses. A registered nurse also admitted she replaced fentanyl and hydromorphone with saline solution for administration to patients.  DEA alleged that Sovah failed to provide effective controls and procedures to guard against diversion, filled controlled substance orders without a system to disclose suspicious orders, and failed to maintain readily retrievable records.  Sovah also agreed to four years of increased controlled substance compliance and oversight.
• Press Release– DEA alleged that Pikeville Medical Center (“PMC”) failed to maintain complete and accurate schedule II inventories and dispensing records that allowed a pharmacy tech to divert 62,780 schedule II doses. The tech’s husband distributed the drugs in the community..  The Kentucky hospital resolved the allegations for $4,394,600 and entered into a three-year MOA in November 2021.
• Press Release– DEA began investigating Cheshire Medical Center (“CMC”) in New Hampshire in February 2022 after it reported that a nurse stole twenty-three fentanyl intravenous solutions (“IV”) bags. CMC later reported an additional 634 fentanyl IV bags were unaccounted for and an audit revealed an additional 17,961 controlled substance doses missing.  The nurse who allegedly stole the drugs died in March 2022.  CMC resolved the allegations by agreeing to pay $2,000,000 and implement a corrective action plan.

Controlled substances are a necessary component in hospitals providing needed medical care to patients.  However, these recent employee diversion incidents cases illustrate the vulnerability of hospitals.  Even trusted employees are capable of bad behavior.  Hospitals that are non-compliant and fail to fulfill their controlled substance obligations pose serious health risks to patients for undertreatment, and to employees for overdose and death.  Hospitals can face potentially multi-million-dollar settlements and significant long-term compliance costs.  Employee diversion can result in unwanted local and national publicity leading to erosion of public trust and confidence.

Ownership and management would do well to ensure that their hospitals’ comply with controlled substance recordkeeping, reporting and security requirements under the CSA and DEA regulations.