Controlled substances (CS) diversion in health systems can lead to serious patient safety issues, harm to the diverter, and significant liability risk to the organization. Diversion driven by addiction puts patients at risk of harm, including inadequate relief of pain, inaccurate documentation of their care in the medical record, exposure to infectious diseases from contaminated needles and drugs, and impaired healthcare worker (HCW) performance.1,2 In addition to patient harm, there are regulatory and legal risks to the organization, including fraudulent billing and liability for resulting damages, and decreased community confidence in the healthcare system. These guidelines provide a detailed and comprehensive framework to support organizations in developing their CS diversion prevention program (CSDPP) in order to protect patients, employees, the organization, and the community at-large. Ultimately, each organization is responsible for developing a CSDPP that complies with applicable federal and state laws and regulations but also one that applies technology and diligent surveillance to routinely review process compliance and effectiveness, strengthen controls, and seek to proactively prevent diversion.3,4
Diversion of CS is common, but it is rarely discussed openly. Some recent high-profile events are raising new awareness to the prevalence of this issue and its implications. It is estimated that 10–15% of HCWs misuse alcohol or drugs at some point in their careers, which is similar to the general population.5 With the role HCWs have in taking care of patients and the accessibility of CS in the work environment, organizations must routinely evaluate their employees, systems, and patient care environments.6,7 It is imperative that healthcare organizations develop CSDPPs that include support systems for the work force (e.g., employee assistance programs, professional monitoring programs), methods to monitor effectiveness of diversion prevention efforts, and patient safety considerations. Education on the signs and symptoms of impaired HCWs—supported by rigorous monitoring and surveillance, human resources management, awareness of state and national diversion reporting requirements, and substance abuse treatment programs—is paramount for healthcare organizations. In addition, healthcare organizations are not immune to the larger societal issues associated with substance abuse, including the recent exponential rise in accidental overdoses, and should therefore ensure that there are systems in place to positively influence prescribing, procurement, dispensing, administration, and proper disposal and wasting of CS.8–15
There are many points where diversion may occur and many methods of diversion (Figure 1). CSDPPs that build in tight control through process checks and balances, diligent surveillance, and prompt interventions are required to prevent, promptly identify, and investigate suspected diversion. Such programs require a rapid response by key stakeholders, using established processes and time frames as defined by the organization. Clear policies, procedures, and lines of accountability should be in place for dealing with such investigations and reporting in a timely and thorough manner.
The purpose of these guidelines is to provide guidance to health systems on planning for and implementing best practices when establishing a comprehensive CSDPP. Establishing a comprehensive CSDPP will require engaged leadership oversight that promotes a culture of organizational awareness, implements and evaluates the effectiveness of systems and processes, and works toward continuous improvement. The guidelines provide recommendations on developing CS diversion prevention strategies and a framework for integrating those strategies into a comprehensive organizational program that ensures successful implementation. The recommendations outline a collaborative, interdisciplinary approach to and accountability for CS diversion prevention and response within the organization. Some topics outlined in these guidelines are the subjects of other ASHP Best Practices documents, which should be referred to for additional information and guidance. Pharmacy leadership and other key stakeholders within healthcare organizations should use their professional judgment when determining applicability to their own needs and circumstances.
These guidelines address all settings in which health-system pharmacies typically have responsibility for purchasing, procuring, and distributing CS, including, but not limited to, inpatient settings, outpatient and community pharmacies, organization-owned clinics, and physician practices. The broad range of CS diversion prevention strategies recommended in this document supports a culture of safety for patients and HCWs and includes a suggestion that healthcare organizations define how to address impaired HCWs. To encourage dissemination and adoption of the strategies and recommendations outlined in this document, Appendix A provides a list of definitions of terms used in this document and in diversion prevention generally. Appendix B provides additional guidance regarding implementation strategies, examples of best practices, and key action steps described within the guidelines that can assist in self-assessment. Some of these approaches are relatively straightforward and can be implemented within the pharmacy. Other approaches are more complex and require collaboration throughout the organization and, in some cases, with vendors. Successful diversion prevention requires systematic attention to and integration of both types of approaches. When selecting and implementing these strategies, it is essential that the organization remains mindful of patient safety and the quality of patient care; patients must still be ensured access to timely care and effective pain management.
Core elements of a CSDPP
A comprehensive CSDPP includes core administrative elements (e.g., legal and regulatory requirements, organization oversight and accountability), system-level controls (e.g., human resources management, automation and technology, monitoring and surveillance, and investigation and reporting), and provider-level controls (e.g., chain of custody; storage and security; internal pharmacy controls; prescribing and administration; returns, waste, and disposal) (Figure 2). This framework is driven by key principles that include a collaborative approach, setting clear lines of accountability and responsibility, implementation of standard processes, and a culture of continuous readiness and quality improvement. When an organization has multiple Drug Enforcement Administration (DEA) licenses, all organization policies and procedures related to the CSDPP should be applied consistently.
Legal and regulatory requirements
The procurement, prescribing, administration, and transfer of CS are highly regulated by federal and state laws and regulations, as well as compliance standards (e.g., those of the Joint Commission and Centers for Medicare and Medicaid Services), and these requirements must serve as the foundation for the organization’s policies and procedures.6,7,16,17 Whether implemented manually or through the use of technology, policies and procedures must reflect current legal and regulatory requirements, including, but not limited to, records retention, biennial inventory, DEA registration and power-of-attorney designations, procurement requirements and forms, prescription authentication, surveillance, investigation and reporting of CS diversion or loss, authorization to access CS (i.e., to procure, prescribe, handle, transport, dispense, or administer), waste, and transfer. When applicable, the CSDPP integrates requirements for state-level CSDPPs and procedures, such as those required by professional licensure boards.
Billing and fraud implications
CS diversion also has billing fraud implications. When there are diversions with known documentation or processes that have impacted the integrity of the billing process, additional actions may be required. Organizations, with input from pharmacy, should take the initiative to self-monitor practices to prevent, identify, and correct potential fraud, waste, or abuse in collaboration with relevant departments (i.e., corporate compliance, finance, and internal audit).18
The organization should be aware of applicable DEA registrations under its control and appoint a registrant who will be accountable for enforcement of requirements. Powers of attorney issued by a DEA registrant should be current and reevaluated on a regular basis (i.e., at least annually). There should be procedures in place for reporting suspected or known diversion to DEA and other appropriate local authorities, with the appropriate person submitting reports in accordance with requirements. Local DEA and law enforcement may vary in their requirements and preferences for how and when to report suspected diversion or theft. Furthermore, states vary in their requirements for who may handle and transport CS, for licensure and registration of providers, and for provider assistance programs. Those responsible for their CSDPP should be familiar with local and state requirements and work collaboratively to minimize risk to the organization and ensure public safety. Organizations should ensure completeness and integrity of required documentation, required elements in manual and electronic forms of documentation (i.e., procurement and disposition records and inventories), surveillance findings and actions, discrepancy investigations, and reports to DEA and other authorities; such documentation should be readily retrievable.
Patient’s own medications, medical cannabis, marijuana, and illicit substances
Healthcare organizations should develop procedures for the disposition of patients’ CS, medical cannabis, marijuana, and illicit substances brought into a facility.19 Procedures should address notification of the local authorities when patients bring illicit substances into the organization, as required by law.20 Pharmacy leaders, representatives of other affected HCWs, and the security department should work closely with the organization’s legal counsel to interpret and weigh legal, regulatory, and accreditation requirements regarding these substances, as well as the rights of individual patients, in developing the organization’s policies. It should be noted that, especially in the cases of medical cannabis and marijuana, possession and prescription laws vary from state to state.
Organization oversight and accountability
It is imperative that organizations establish a CSDPP that discourages diversion and strengthens accountability, rapidly identifies suspected diversion and responds to known or suspected diversion incidents, and continually seeks to improve controls. Strong organization oversight with broad HCW participation and a clear accountability structure provide a framework for a capable program.
Organizations should support the CSDPP by providing adequate resources, including human resources, facility controls, and technology. The pharmacy executive, whose central role is responsibility for the organization’s medication-use system, will be an essential resource for a successful CSDPP. Key elements for organization oversight and accountability include the following (See Appendix B for additional guidance.):
The organization establishes an interdisciplinary CS management program in compliance with statutory and regulatory requirements and with systems that discourage diversion and enhance accountability. Established policies and procedures address all points of access, reflect a segregation of duties where there are overlapping processes for diversion risk, and ensure that the chain of custody and individual accountability are maintained and verifiable at all times. To ensure that they are current, meet applicable practice standards, reflect best practices when possible, and are consistent with other organization policies, CS-related policies are reviewed at regular intervals and when there is a notable change in the organization’s circumstances.
HCWs authorized to access or handle CS are trained and competent in established policies, procedures, and regulatory requirements.
As part of its CSDPP, an organization defines a structure that identifies and supports specific organization accountabilities with respect to oversight and implementation of the program.
The organization establishes an interdisciplinary CSDPP committee to provide leadership and direction for developing policies and procedures and for overseeing the CSDPP. The CSDPP committee is proactive in its prevention efforts and addresses prevention control, diversion detection, incident investigation, and reporting procedures.
The CSDPP committee is led by a designated diversion officer who coordinates all aspects of the program. The functions of this committee are integrated with existing compliance management programs, and the committee reports at least quarterly directly to the senior leadership of the organization.
Committee members are identified and have clear roles with defined expectations. Suggested committee membership includes staff from the following departments: medicine, anesthesia, pharmacy, nursing, security, human resources, compliance, risk management, administration, legal, media/communications, information technology, and employee health. Pharmacy should have a leadership role on the CSDPP committee.
A diversion response team should be established to respond immediately to suspected incidents, with stakeholder notifications tiered and based on the stage and findings of the investigation.
Human resources management
It is important that healthcare organizations approach CS diversion prevention with the same diligence they would apply to any potential compromise to patient safety and create a culture of awareness that supports an effective organizationwide CSDPP. A comprehensive human resources approach to support the CSDPP should at a minimum include (1) a written employee and provider substance abuse policy, (2) an HCW education and awareness program, (3) a supervisor training program, (4) an employee and provider assistance program, (5) peer support and systems (e.g., pharmacist recovery networks), (6) requirements for drug testing, including a for-cause policy for drug testing, (7) return-to-work policies for HCWs,21 and (8) sanctions for performance and diversion violations. Pharmacists should participate in or contribute to the development of substance abuse prevention and assistance programs within healthcare organizations.22
First and foremost, organizations must implement policies to protect patients from potential harm related to substance abuse and diversion and have a process to remove an HCW suspected of being impaired from delivering patient care and to prevent further access to CS either pending investigation or after a confirmed diversion or policy breach. Organization policies should ensure compliance with federal and state laws regarding referral to local law enforcement and applicable licensing boards. The organization’s senior leadership should determine the repercussions or sanctions for violations and for confirmed thefts or diversion and should ensure that those repercussions or sanctions are consistently applied across all disciplines. HCW sanctions should not vary depending on whether the HCW is supporting his or her own addiction (or that of an associate) or there has been theft of CS for sale and financial gain. The organization’s substance abuse policy should address circumstances in which an HCW is discovered to be diverting to support an addiction. Such diversion should be addressed as theft and referred to local law enforcement and applicable licensing boards. The substance abuse policy should also address actions to take when a person separates from the employer during the course of an investigation, including when the organization should inform local authorities and notify the relevant licensing board.
There are signs that signal possible CS diversion, and all HCWs need to understand their role in recognizing diversion. The organization’s senior leadership should communicate the expectation that HCWs speak up when they become aware of or suspect an issue related to CS diversion and should ensure that HCWs will be protected from retaliation if they report a suspected issue related to CS diversion. The organization should therefore establish and communicate ways for HCWs to speak up anonymously (i.e., hotline, paper, or electronic submission). The organization should treat such information as confidential and take all reasonable steps to protect the confidentiality of the information and the identity of the employee furnishing the information.
All HCWs should receive initial orientation and annual education in diversion prevention and substance abuse and diversion awareness (signs and behavior patterns and symptoms of impairment) and reporting options. Education on medication diversion and CS policies and procedures should be required before granting an HCW authorization to access CS. The organization should emphasize the importance of reporting the signs of a potentially impaired HCW or suspected CS diversion and the potential impact on patient care, including ramifications for failure to report. Employees should be made aware that random compliance checks will occur and that employees will be held accountable for complete compliance with policies, laws, and record-keeping requirements. Managers should also receive training about signs, symptoms, and behavior alerts; what to do when they suspect an HCW is impaired; managing an HCW in recovery; and their responsibilities should they become aware of a known or suspected diversion.
The organization should establish a process to support recovery for HCWs who are diverting CS for an active substance abuse problem (i.e., an employee assistance program process, which may include mandatory program referral, reporting to the relevant state board program, and a contract for the HCW’s return to work). Drug testing for cause should be permitted, and, as required for investigations or by licensing boards or other employment contracts, organizations should implement reliable testing and validation for drug screening. The organization should have policies to address the assessment of an HCW’s ability to return to patient care when there has been a for-cause investigation. Furthermore, the organization should have a policy that addresses how to handle situations when there may be an additional impact on patient care, such as an infection control risk, and should address requirements for further testing (e.g., human immunodeficiency virus, hepatitis C).
If provider services are contracted, contracts should ensure that all contracted workers receive employee education regarding CS and that the contracted company will immediately notify the organization if there is disciplinary action against an HCW or if an HCW is removed because of an impairment issue.
Organizations will need to establish policies and procedures to manage situations in which diversion results in an HCW overdose or death in the workplace. These situations will require all of the investigation and discovery aspects of any suspected diversion but will also require that determinations be made regarding which authorities need to be immediately contacted, whether evidence will need to be quarantined, and whether and how the chain of custody will be documented. See Appendix B for additional guidance.
Automation and technology
Automated technology, including automated dispensing and prepackaging devices, and diversion monitoring software have been developed to assist with the management of CS, including inventory control; documentation of removal, administration, and waste; billing; and auditing.23 The level of automation may depend on the risk assessed by the organization for various areas. For example, areas commonly considered to be high risk include the main pharmacy CS vault, anesthesia and procedural areas, emergency departments, surgery centers, and remote locations. When available, automated solutions that support adequate control, surveillance, and auditing processes should be implemented. Despite their perceived ease of implementation and use, automated dispensing and surveillance technologies still require diligence in the development of meaningful and readily retrievable reports, investigation of trends and variances, and review of the impact of changes in the automation technology. Pharmacists and other stakeholders in the organization should engage only vendors who will work collaboratively to develop adequate implementation testing, HCW training, and maintenance and upgrade plans for their technology solutions. Key elements of automation and technology to support a CSDPP include the following (See Appendix B for additional guidance.):
An interdisciplinary team that includes pharmacy representation participates in the selection and implementation of all medication-related automated systems (e.g., surveillance software) and technology (e.g., automated dispensing devices, syringe and infusion pumps, security devices) to ensure they support diversion control, surveillance, and auditing of CS and meet legal, regulatory, and functionality requirements. Pharmacy has an integral role in the selection and implementation process. Any changes or upgrades to existing technology are reviewed by key stakeholders, including pharmacy, to assess the impact on systems of control, surveillance, and auditing, and the changes are tested and vetted to ensure that implementation meets legal, regulatory, and functionality requirements. A report of this assessment and any gaps identified with the new system/upgrade and a plan for remedy are documented in a formal report and reviewed by the CSDPP committee before implementation.
CS management automation and technology vendors collaborate with healthcare organizations to provide adequate solutions that support control, surveillance, and auditing functions that address the entire chain of custody, up to and including administration to the patient, and have the ability to track waste, identify discrepancies, and pull data from technology systems into actionable reports, including, but not limited to, trending of information that supports diversion surveillance.
Records generated from technology solutions are readily retrievable and contain information required to conduct investigations and fulfill investigator requests. Reporting capability is tested to ensure that data within reports are complete, accurate, and integrated into actionable reports that are readily retrievable.
Systems are utilized in high-risk areas with high-volume CS (e.g., surgery or anesthesia areas, central pharmacy).
Integrated systems are utilized in high-risk areas (e.g., auditing software, automated dispensing devices).
All HCWs are adequately trained regarding their roles and responsibilities in the use of automation and technology, including surveillance capabilities, and their competency is assessed. Competency is assessed when an HCW assumes a new position, annually, or when there is a relevant change to existing technology.
A pharmacist is designated to oversee automated dispensing devices, including selection, maintenance, and inventory management, and to ensure that procedures are in place to limit access to CS in automated dispensing devices by minimizing the number of authorized individuals with access, as well as the ability to immediately add or rescind access privileges.
Policies and procedures that address access, security, and documentation are established in the event of automation downtime or system failure.
Monitoring and surveillance
The organization, through its CSDPP committee, should define, review, and audit relevant data that could indicate potential CS diversion and ensure that trends and variances are acted on in a timely manner and that corrective action plans are implemented (Figure 3). All variances should signal an opportunity for improvement. CS monitoring and surveillance rely on the availability and use of data and information, including timely access to actionable reports that support an effective surveillance and detection system. Furthermore, the CSDPP should assess the comprehensiveness and level of documentation and response to suspected diversion events and compliance with established policies and procedures. Automated systems and diversion monitoring software are recommended to support efficient surveillance, particularly for high-risk or high-volume locations.
The CSDPP committee, with input from the designated diversion officer, designated pharmacist representative, and pharmacy compliance team (if applicable), should oversee the organization’s monitoring and surveillance efforts, including identifying required and routine compliance reviews, determining surveillance metrics for trend reports, assigning responsibility for and frequency of review, providing facility oversight, and conducting established audits of facility-based diversion monitoring and documentation of suspected diversion events. The organization, through the CSDPP committee, should establish surveillance requirements, including the definition of monitoring and surveillance measures, thresholds of variance that require action, reporting frequency, and surveillance procedures. The organization, through the CSDPP committee, should ensure that all elements are implemented, conducted in a timely manner, investigated, and reported as required. All systems of control should be regularly audited for compliance on a scheduled basis. The CSDPP committee should provide facility oversight to ensure that established audits for facility-based diversion monitoring are conducted and documented. The use of diversion monitoring software to support surveillance activities is recommended.
Surveillance processes should be interdisciplinary and touch all aspects of the CS management system, from purchasing, inventory management, administration, waste and disposal, and documentation through expired-product management. CS auditing should be performed on a regularly scheduled basis, as determined by processes in a particular area, such as anesthesia, patient care units, special procedure areas, ambulatory care areas, and the pharmacy, focusing on identified risk points (Figure 1) and previous events. Self-audits should be conducted within areas as well as regularly scheduled audits by individuals external to the area being audited. The organization should periodically audit compliance with all diversion controls, including human resources requirements for individuals authorized to handle CS (i.e., completion of required background checks, documentation of training and competency requirements for authorized HCWs, compliance with licensure board reporting, testing for fitness for duty, random drug-testing requirements, and compliance with rehabilitation program requirements). Important examples of recommended surveillance practices include the following (See Appendix B for additional guidance.):
The healthcare organization assigns a pharmacist, with adequate support staff and dedicated time for surveillance monitoring, who is accountable for optimizing the implementation and functionality of automated dispensing devices and diversion monitoring software reporting capabilities. Other disciplines (e.g., nursing, quality assurance, anesthesia providers) are actively involved in surveillance monitoring and audits and assist with evaluation of trends and incident investigation.
Processes for procurement surveillance are followed by all areas (e.g., research areas) that purchase CS under their own DEA license. For all purchases, authorization (e.g., power of attorney) is verified. The healthcare organization reviews purchase history through regularly scheduled audits to identify diversion through variations or changes in volume or pattern. CS purchase invoices are compared with CS orders and receipt into the pharmacy’s perpetual inventory. Because the invoice–receipt pair may be removed with CS diversion, invoices also are reconciled to statements or wholesale purchase history reports to detect missing invoices. A process is in place to identify unusual peaks in quantity or frequency of CS purchased and to conduct periodic reviews of the quantity of CS removals from the main inventory to patient care areas compared with actual documentation and/or patient care charges.
Verification of a perpetual inventory should be conducted on a regular basis with the frequency consistent with the controls to limit the time frame for discovery. It is important to identify inventory discrepancies in a timely manner so the reason for the discrepancy can be more easily investigated. CS managed through automated dispensing device counts are verified (by blind count) each time a CS drawer is accessed. A complete inventory for CS in automated dispensing devices is conducted weekly, and CS storage areas outside automated dispensing devices are inventoried at each shift change by two authorized HCWs. CS inventory in the pharmacy narcotic vault is counted at least monthly. A biennial physical inventory of all CS is completed and documented per DEA requirements (or per state requirements, whichever is the more strict interpretation). Movement of CS throughout the organization is traced, and all transactions are reconciled (e.g., reports match narcotic vault transactions with receipt into the automated dispensing device and/or paper inventory record with nurse signature of receipt).
Prescribing practices and prescribing trends are evaluated, and significant variation from peers should be reviewed.
Automated dispensing device reports are reviewed at least monthly by pharmacy and patient care managers as defined by the organization, and the results of the review are documented. Reports compare automated dispensing device activity with medication administration records. Patient response to medication (i.e., pain management) is also evaluated against medication administration records, documentation of response, and patient interview. The medication record is reviewed for the amount and quantity administered and compared with what other HCWs administer on subsequent shifts (when there is no change in patient condition).
Nursing management integrates routine auditing and surveillance activities into core daily, weekly, or monthly responsibilities, including staff education regarding signs of diversion, symptoms of substance abuse, and diversion-reporting procedures; review of nursing removal, return, and wasting records; development, implementation, and monitoring of procedures for witnessing CS-related transactions; and investigation and reporting of suspected diversion in accordance with organization procedures.
Nursing management conducts random patient interviews to verify that patients received pain medication and that the medication adequately controlled pain and also compares responses to nursing patient assessment notes and medication administration records. Inconsistencies found on patient interview may point to diversion at the time of administration. When possible, medication administration is integrated with clinical assessment in the electronic medication record. Incidents in which pain response is not as expected and all nurses are experiencing similar lack of medication efficacy are reported to the pharmacy for further investigation of product integrity; there are case reports of prepackaged CS containing the wrong medication, and these circumstances could signal a medication error.
A process is in place to resolve CS discrepancies and specify the time in which discrepancies must be resolved. It is recommended that CS discrepancies be reported to the supervisor in charge and resolved as soon as possible upon discovery, preferably no later than the end of the work shift, and that discrepancies deemed to be resolved are reviewed by the supervisor to ensure the legitimacy of the resolution. Discrepancies that cannot be resolved (“unresolvable discrepancies”) are reported immediately to pharmacy and are jointly reviewed by pharmacy and patient care leadership, with resolution within 24–72 hours.
Pharmacy is immediately notified of and supports the reconciliation investigation when an unresolvable discrepancy is discovered, and a pharmacist is responsible for overseeing the investigation of the discrepancy, even when a technician assists with these duties.
A trend of poor documentation practices by HCWs is reviewed for possible diversion. Provider transactions are reviewed for poor documentation patterns (e.g., failure to document, corrections in the pharmacy CS vault or automated dispensing machines), and trends of users and cosigners are tracked.
Pharmacy reconciles CS in high-risk areas, such as surgery and anesthesia areas, by comparing the amount dispensed with the amount documented on the CS administration record and the amount documented as wasted.
The organization identifies specific high-risk CS medications that are randomly assayed, and procedures include random testing of waste from all high-risk or high-volume areas (e.g., pharmacy sterile products preparation, surgery and anesthesia areas), as permitted by and in accordance with state and federal rules and regulations.
The organization should identify high-risk areas (e.g., surgery, anesthesia, and sterile compounding areas, emergency departments) and include an assessment of risk for diversion (e.g., known diversion points), ease of detection (e.g., high-volume locations, level of oversight and controls, state of awareness of patients), and probability of harm (e.g., potential to impact the quality of care). Automation and technology should be utilized in high-risk areas to facilitate security controls and surveillance. High-risk areas should be defined by the organization but include areas where the same provider is prescribing, obtaining, preparing, and administering the medication, such as surgery centers, operating rooms, and procedural and anesthesia areas. High-risk areas are also locations where high volumes of CS are ordered, prescribed, stored, and dispensed within the same location. The main pharmacy is considered a high-risk area.
Anesthesia and operating rooms are high-risk areas for which organizations should consider additional policies and procedures. Documentation of doses administered in the health record should be routinely reconciled with documentation of doses dispensed, waste, and return quantities as well as prescribed doses. The pharmacist should be responsible for all drugs and CS dispensed and distributed in the setting. Pharmacy technicians, under the supervision of the pharmacist, could be assigned most of the responsibility for these daily activities as permitted by state and federal law. If there is a satellite pharmacy, minimal drug stock should be kept in each surgical suite, and additional drug inventory should be maintained within a pharmacy location to the extent possible.
Satellite pharmacies supporting surgery and procedural areas should be staffed whenever the areas providing surgery and administering anesthesia are normally staffed. If the satellite pharmacy is not open 24 hours a day, it may be necessary to establish an after-hours drug supply. The pharmacy and anesthesiology departments should collaborate to decide the drugs and quantities required for this supply, including an assessment of the smallest appropriate dose and packaging, and the accountability system to be used. Supply levels should be checked, reconciled, and replenished daily. Dedicated pharmacy resources within the perioperative area allow for more active and timely monitoring of CS utilization and identification of possible diversion. Systems to track drugs used, adjust par levels as needed, and monitor drug expiration dates should be devised. The ASHP Guidelines on Surgery and Anesthesiology Pharmaceutical Services provide specific guidance on best practices unique to CS management for these patient care areas and services.24
Investigation and reporting of suspected diversion
It is imperative that there is a detailed and thorough approach to investigating and reporting suspected diversion. Incomplete investigations and follow-up can have serious patient care, legal, and compliance implications. Any unresolvable discrepancy should be considered a possible diversion and escalated to an investigation, with notifications to occur as defined in the organization’s CSDPP. Processes should be in place to prompt an immediate investigation, the appropriate internal and external communications, and the completion of required reporting. Although the supervisor in the area where diversion is suspected will assist in conducting the investigation, those external to the area should be involved to ensure that biases do not influence the investigation. The pharmacy director or his or her designee and diversion officer (if different) should be notified immediately of any suspected diversion within the organization and participate in all active investigations. Investigation and reporting procedures should include the following (See Appendix B for additional guidance.):
Guidance is provided with regard to the review process, including who will coordinate the investigation, appropriate team members, leadership and organization legal counsel notification, documentation of the investigation, and coordination of internal and external reporting.
Investigations are conducted as thoroughly and completely as possible; at a minimum, reporting occurs when it is determined that the discrepancy is unresolved or that there has been a known theft or diversion. As the investigation proceeds, there is an escalation and broadening of notifications specified in the policies and procedures defined by the CSDPP.
If the organization becomes aware of an arrest of an HCW for illicit use of CS, the organization immediately conducts an investigation of the HCW’s transactions to assess whether diversion has occurred. The organization assesses whether to suspend, transfer, or terminate the employee or take other action (e.g., remove access to CS) or impose other sanctions against the HCW. The organization immediately removes access privileges to CS if diversion is suspected until the investigation is completed and a determination of diversion or other risks to patient care is made.
The organization establishes guidelines for engaging external entities, such as DEA, licensure boards, laboratories (for testing), and local law enforcement. Guidance is provided with regard to review processes to determine who is required to be notified, when to notify, who is responsible for contacting the agency, and other circumstances for the notification. The organization fulfills reporting requirements for diversion or other unaccountable loss of CS in accordance with laws and regulations.
The organization defines, in accordance with the law, when a DEA Form 106 should be completed for discrepancies that remain ultimately unresolved. There are clear responsibilities for completion of DEA Form 106 for a theft or significant loss, who is to be notified, and when. Even if the loss cannot be quantified due to the nature of the diversion method, DEA should still be notified.
For significant diversions, a quality-improvement review should be initiated by the CSDPP committee, including a root cause analysis and recommendations to prevent future occurrences. Representatives from the area where there is a suspected diversion should be engaged in the investigation and refinement of prevention strategies. Furthermore, the CSDPP should coordinate a proactive diversion risk review, such as by conducting a failure mode and effects analysis, of processes, particularly when new drug products and dosage forms are approved, new technology or technology upgrades are being implemented, and new drug delivery systems are implemented. Results of the risk review should be used to make system improvements as part of the organization’s performance-improvement activities.
The organization should have a clearly defined, full-disclosure policy and process to communicate to patients and families that are affected by CS diversion. The organization should also have guidelines for engaging the media and managing external public relations. Policy and processes should specify when to notify the media, what internal communications are required, and who is responsible for contacting the media representative and approving media communications.
Chain of custody
Effective diversion control systems depend on implementing retrievable evidence that the chain of custody is maintained at all times and at all points when the transfer of CS occurs between individuals, whether within or external to the pharmacy (i.e., courier transport to other facilities, use of pneumatic tube systems, transfer to emergency medical service providers, or transfer from contract pharmacy services). Chain-of-custody controls depend on the ability to reliably audit the trail of transfer. The organization should establish and enforce a policy stating that employees with access to CS may not delegate their access to another employee in a way that will alter the audit trail for the chain of custody (e.g., not sharing electronic medical record, automated dispensing device, or pharmacy door passcodes; not providing key access and entry to unauthorized HCWs). The delivery of CS to a storage location without witness and receipt confirmation by another authorized HCW may not meet the intent of the chain of custody requirement. In addition, controls should be built in when transfer is made via transport mechanisms (e.g., a pneumatic tube system) to ensure that the CS is received and verified as received by an identifiable, authorized individual.
Measures should be in place to ensure the integrity and security of CS and the safety of personnel transporting CS to offsite locations. Secure, lockable, and tamper-evident delivery containers (i.e., carts, trays, or boxes) should be used to deliver CS. Packaging should not make apparent the contents (e.g., an opaque container). When used, locking mechanisms should be tamper-resistant and traceable (e.g., plastic tie locks with unique numerical identifier). The chain of custody should also apply to laboratory services (internal or external) used to analyze syringes or other products as part of an investigation or random assay process.
If CS are provided to emergency medical services (e.g., ambulance services), the organization should ensure that procedures are in place that comply with local and state requirements and ensure that the chain of custody is maintained and the disposition of CS is documented and retrievable. See Appendix B for additional guidance.
Storage and security
Storage and security of CS require a coordinated approach that includes facility controls (e.g., camera surveillance), physical access controls (e.g., locks or biometric access technology), and frequent inventory checks and surveillance to allow discrepancies to be discovered in a timely manner. Key elements of CS storage and security include the following (See Appendix B for additional guidance.):
CS are stored in a locked and secured location (e.g., automated dispensing devices, safe, locked cabinet/drawer) at all times unless in the direct physical control of an authorized individual. When implementing or assessing facility and physical access controls, the security and safety of HCWs are taken into consideration.
Storing CS in transportable lock boxes or “fanny packs” is avoided. If used, such lock boxes follow the same requirements for storage, security, and chain-of-custody controls as other inventory. Transportable lock boxes are not considered secure and are stored in a locked area accessible only to authorized personnel when not in use or otherwise unattended.
Lock-out times for electronic locks on carts (e.g., medication or anesthesia carts) containing CS are limited to the narrowest window of time that is appropriate for the particular setting.
There is a defined process to ensure that only authorized individuals have access to CS. Access to CS storage areas is minimized and limited to authorized personnel. There is a complete assessment of all HCWs with access privileges to ensure that only those permitted to access have access (i.e., currently employed, temporary employees, or licensed independent practitioners with privileges), and removal of access privileges occurs immediately upon separation.
There are policies and procedures regarding CS access, including restrictions through assignment, key controls, and the use of passwords. For automated dispensing devices, biometric identification with a user ID is preferred over passwords. CS cabinets and carts that are not automated dispensing devices are secured with an electronic lock that requires a user-specific biometric identification, code, or badge swipe. Access is recorded and retrievable for surveillance.
Where traditional key lock security and manual inventory systems are used, there is a procedure to track keys, secure keys after hours, replace lost keys, and change locks. Any HCW authorized to have access to or prescribe CS will be able to provide an appropriate photo identification upon request.
The physical plant should provide for monitoring of secure locations (e.g., video surveillance and recording), particularly in high-volume storage areas at risk for theft and diversion, such as the main pharmacy vault, inventory storage location, and packaging areas.
Camera surveillance should be considered (1) in locations where there is high risk for diversion, (2) in locations where electronic or biometric access is not available, (3) in remote locations, and (4) to assist with an active diversion investigation.
Automated dispensing device technology should be utilized in high-volume CS areas, including the pharmacy, anesthesia and surgery locations, high-volume clinics, and outpatient procedure areas.
When delivering CS to an automated dispensing device, restocking an automated dispensing device, or pulling returns from the return bin, there should be a witness or other verification process (as previously described in the Monitoring and Surveillance section).
Controls are in place to monitor pharmacy inventories for discrepancies. Within pharmacy areas with automated dispensing device vault management, CS are manually inventoried by two rotating, licensed, or otherwise authorized pharmacy personnel (e.g., pharmacy technicians) monthly. For high-volume or high-risk areas, more frequent verification audits are considered to prevent or minimize inventory count discrepancies and minimize the time window for discovery of the discrepancy. At least one of those conducting the inventory is a licensed pharmacist. For pharmacies without automated dispensing device vault management, a physical inventory is conducted at least once per month but preferably weekly. The inventory count includes expired or otherwise unusable CS awaiting disposal or transfer to a reverse distributor.
CS counts managed by automated dispensing devices or done manually are verified by a blind count each time a CS drawer, pocket, cabinet, or refrigerator is accessed, except when unit-of-use dispensing technology is deployed.
Inventory verification is conducted for CS managed by automated dispensing devices by two authorized HCWs if a blind count has not been performed within one week. CS not managed by automated dispensing devices are manually inventoried by two authorized HCWs at the beginning and end of every shift when the area is open for services.
Patient-specific CS infusions are contained in a secured lock box utilizing no-port tubing unless under constant surveillance. Keys and access to these controls are limited and tracked as with any keys and lock boxes.
Documents used to procure or prescribe CS (e.g., DEA Form 222, blank prescriptions) are secured and monitored with the same diligence as CS to prevent theft or loss.
CS brought into the hospital by patients
Procedures are established that address special circumstances to ensure controls are in place to secure CS and prevent diversion of CS brought into the organization by patients. Patients should be encouraged to return their own medications to home via a family member or agent when possible. CS should only be accepted when they are to be administered to the patient pursuant to a medication order. These medications should be inventoried and secured as with other CS in the patient care area and returned to the patient at discharge. Documentation of the patient’s home medication, quantity inventoried, and signatures of two verifying HCWs should be recorded in the medical record upon receipt and at patient discharge. The patient or patient’s representative should sign that he or she has received the medication and its quantity. CS that cannot be returned to home and are not to be administered to the patient are to be inventoried and removed from patient care areas with appropriate chain-of-custody documentation and stored securely per organization policies, which include procedures for returning CS to the patient or authorized persons and management and final disposition of CS if not returned to the patient or authorized persons. The organization should, in collaboration with local and state authorities, consider providing a public receptacle for disposal of CS by patients. When patients bring illicit substances into the organization, procedures should address notification of the local authorities as required by law.19,20
Internal pharmacy controls
Internal pharmacy controls include controls related to procurement, preparation, and dispensing of CS. These processes typically apply only to pharmacy locations. Diversion can occur at various points within these processes, and it is important to apply key principles to effectively minimize opportunities for diversion. Key principles include limiting the number of people authorized to order CS, creating separation of duties and rotation of HCWs through various responsibilities within the process, and observing for variation in processes. It is recommended that these processes be audited by external (to the pharmacy) review at least biannually. Examples of recommended procurement, preparation, and dispensing controls follow; see Appendix B for additional guidance.
All CS are procured from the pharmacy. If other departments or individuals are authorized to procure CS, there are checks and balances established to ensure the same policies and procedures are consistently followed throughout the organization.
There are purchasing safeguards in place that prohibit ordering of CS by those not authorized by the organization. CS may only be ordered by authorized individuals (DEA registrant and those with power of attorney granted).
An electronic CS ordering system (CSOS) is utilized, eliminating or minimizing use of paper DEA Form 222s.
When paper DEA Form 222s are used, those forms are locked in a secure location, recorded on a perpetual inventory log, and accessible only to those authorized to procure CS. CSOS order files are backed up to an organization-based system to ensure that archived files are readily retrievable by designated personnel.
Separation of duties exists between the ordering and receipt of CS. Two authorized individuals count and check in CS received and confirm that the order, invoice, and product-received documentation match. At least one of the receivers is licensed. The process is overseen by a licensed pharmacist.
There is a process to investigate and remedy discrepancies when CS are received in the pharmacy from the wholesaler or other distributor.
There are processes to track, reconcile, and audit CS products where preparation is outsourced to and received from a third party.
Procedures exist that ensure the chain of custody is maintained for interorganization transfer or transport of CS (e.g., from a central distribution hub).
Procedures define the controls and documentation required where CS are transferred between pharmacies.
All CS procurement paperwork is reviewed for completion and filed according to applicable laws and regulations. Procedures are in place for patient care areas of the organization that are considered under common control that support the pharmacist-in-charge to provide oversight and authority to ensure proper procurement controls are being utilized.
Preparation and dispensing controls
A perpetual inventory is maintained, and a blind-count process is used when adding or removing CS from a pharmacy inventory location.
Access to inventory is limited, with controls to identify who accessed the inventory, when the inventory was accessed, and what changes were made to the inventory; access provides a readily accessible audit trail.
To minimize diversion through drug product alteration or tampering, drug products are inspected for alteration or tampering, and any potential discrepancy is investigated for possible diversion.
To minimize diversion during repackaging, CS are purchased and dispensed in unit dose packaging whenever possible. Diversion controls are in place when CS are repackaged, and repackaged products are routinely inspected to ensure product integrity.
Delivery and restocking of CS in patient care and procedural areas require an auditable verification of delivery and receipt.
Returns from the patient care and procedural areas (e.g., emptying a return bin) have an auditable verification of return. Returns are inspected for integrity.
Prescribing and administration
CS may only be ordered by licensed authorized prescribers with DEA authorization. When possible and as permitted by law, CS orders are generated and transmitted by electronic systems with controlled access, except in emergency situations or when impractical. When written prescriptions are used, there are controls in place to track and secure these prescriptions and paper used to print prescriptions (see the Storage and Security section). Order sets and guidelines that include CS should be evaluated and supported by clinical evidence. Guidelines, restrictions, and diversion controls should not delay patient treatment or compromise patient comfort. Key elements of prescribing and administration diversion controls include the following (See Appendix B for additional guidance.):
A valid order from an authorized prescriber exists for all CS administered, and the number of CS allowed via automated dispensing device override status is minimized.
There is a process to identify and verify authorized prescribers within either an electronic or a manual ordering system. There is also a process to identify and verify authorized prescribers and prescriptions written by medical residents or other providers who are authorized to prescribe CS under the organization’s DEA registration (e.g., use of a suffix).
Pharmacists clarify orders for which the prescriber or order is questionable with regard to prescriber identity or other legitimacy of the prescription or order.
Active prescriptions and orders for CS are reevaluated regularly, and CS orders are reordered per the organization’s policies when a patient transfers to a different level of care. The medical staff, in coordination and consultation with pharmacy, determines and establishes an automatic stop-order system for CS when there is not a specific time or number of doses prescribed. CS are retrieved from the storage location and administered to patients by a licensed provider within his or her scope of practice, and such administration is documented in the medical record. When administration is scheduled “as needed,” the administration can be correlated to the patient assessment (e.g., pain scale).
Access to medications for a particular patient is suspended immediately at discharge.
CS are retrieved from inventory by the authorized HCW responsible for administering the medication as close to the time of administration as possible. Procedures for exceptions in emergency situations or settings are defined, and these exceptions are reviewed for appropriateness. The CS retrieved for a patient is the package size equivalent to, or the closest available to, the dose to be administered.
CS packaging (e.g., vials, prefilled syringe systems, unit dose packages of oral dosage forms) is inspected for integrity when being inventoried, before dispensing, and upon administration.
Generally, outside of pharmacy compounding areas and in patient care areas, CS are not drawn up into syringes in advance, and sequential dosing is avoided, recognizing that these processes may be necessary in some procedural areas. Specifically, single-dose syringes and vials are not used to deliver multiple doses. The syringes prepared in these procedural areas are labeled as required by approved procedures and kept under the direct control of the person preparing the syringes until administration. When sequential doses are required from a single syringe (e.g., during procedures), there is a method in place to track the doses ordered versus those administered.
Policies and procedures address the documentation of CS issued but unused, and there is a process to return the unused CS to inventory. Returns should be placed in a one-way, secure return bin and not sent back to the automated dispensing device. These products should not be restocked until inspected for tampering.
Returns, waste, and disposal
To minimize waste, CS are stocked in as ready-to-use form as possible (e.g., avoiding the use of multidose vials) and in the lowest commercially available units for doses frequently prescribed for patients. Waste may include products expiring, products prepared for administration but not administered to the patient (e.g., when a physician discontinues or a patient refuses administration), and drug product remaining after a partial dose is removed from its packaged unit. Waste may also include overfill in vials and drug product remaining in transdermal delivery systems. The organization’s waste-handling practices should maintain chain of custody to minimize the risk for CS diversion. CS should be wasted immediately or as close to the time of administration as possible.
The wasting of all CS requires an independent witness and documentation; at least one, but preferably both, of the witnesses should be licensed. Procedures should define what constitutes complete and timely documentation of waste. An individual witnessing CS wasting should verify the product label, that the volume or amount being wasted matches the documentation, that the drug product being wasted physically matches the drug product in the documentation, and that the wasting occurs per policy for safe disposal and in a manner that makes the CS irretrievable. The entire process of drawing up and wasting from a vial should be witnessed so the individual verifying can be certain that the actual CS is being wasted and not a substituted or adulterated product. Approved methods for returns, wastes, and disposal of CS are defined in federal, state, county, and municipal laws and regulations. Key elements of returning, wasting, and disposing of CS include (See Appendix B for additional guidance.):
All issued but unused CS that may be potentially reusable are returned to the pharmacy or to a designated, secure return location. All returns to the pharmacy and when using a reverse distributor require that the chain of custody be maintained and that witness of transfer is documented.
In patient care areas where waste is documented through the automated dispensing device, the waste is documented in the same device from which the medication was removed.
In patient care areas, unless selected for random assay (see the Monitoring and Surveillance section), unusable CS products, including patient-specific partially used preparations, are immediately wasted and witnessed by authorized individuals per specific organization procedures. Procedures ensuring that the chain of custody is maintained are established when waste is transferred to the pharmacy for conducting random assays.
Partially used preparations or containers are not returned to the pharmacy for disposal, except for purposes of random assay. The act of wasting and the documentation of CS waste are completed by the same HCW who accesses and administers the medication, when feasible. Examples of cases in which this may not be feasible include wasting a CS infusion, patient-controlled analgesia cartridge, or multiday patch. Within the pharmacy, CS waste from compounded sterile preparations is wasted with a cosignature and randomly assayed at least quarterly.
CS overfill is considered an unusable product and is wasted and documented according to established procedures.
For defined high-risk areas (e.g., surgical, anesthesia, procedural, high volume) and/or specific high-risk CS medications (e.g., fentanyl), waste is witnessed and reconciled with an authorized HCW. Approved methods for wasting CS are defined in policies and procedures and comply with universal precautions and organization waste disposal requirements.
Waste containers with any unusable CS product are secured to prevent tampering or made otherwise nonretreivable.
Expired CS are clearly identified as such and stored in a separate secured location from other medications, and inventory is monitored until return via a reverse distributor or destruction and disposal in accordance with legal requirements. Before final transfer to a reverse distributor, DEA Form 222 is audited against amounts transferred. Expired or otherwise unusable CS are not retained or stored in the pharmacy for long periods of time, and the frequency of returns ensures that inventory is not allowed to accumulate. Returns or destruction occurs at least quarterly.
Although it is not possible to predict all scenarios, and procedures need to be customized for unique circumstances and settings, these guidelines present core principles applicable to all settings. Examples of areas with special considerations include both high- and low-volume areas, such as ambulatory care surgery centers, organization-owned physician practices, emergency medical services, research areas, off-campus clinics, long-term care facilities, home infusion services, and retail pharmacies.
Over 30% of hospitals and health systems operate retail pharmacies.25 It is important to also understand and address controls unique to these operations. Organizations should include their retail pharmacies within the scope of their CSDPP oversight and proactively seek to improve controls, due to the high risk of diversion. Retail pharmacies within health systems pose a significant risk to the organization’s CS supply chain because of potential theft and the possibility of receiving fraudulent prescriptions. Retail pharmacies should be aware that they are at risk for both internal and external theft and diversion. Schedule III, IV, and V CS are often stocked in bulk containers on shelves with limited physical access controls. To prevent external theft, these bulk CS containers should be stored with non-CS inventory, where permitted by law.
Security measures, such as camera surveillance throughout the pharmacy, are imperative to deter and monitor for suspected theft and provide an avenue for discrepancies to be resolved in a timely manner. Badge reader or biometric access should be required for access to all Schedule II CS storage areas. These systems provide a physical access control, limit access to appropriate personnel, and create a perpetual log of employees who have accessed the storage cabinet. Schedule II CS requiring refrigeration should be stored among other refrigerated medications.
Inventory adjustments to CS medications pose a significant internal diversion risk. Depending on who within the pharmacy has security access to perform CS inventory adjustments, retail pharmacies should consider having auditing systems in place to track and validate inventory adjustments performed by staff. In addition, routine reports should be run to compare CS purchases with utilization to identify discrepancies in inventory and dispensing trends. In addition to CS inventory adjustments, CS prescriptions in will call and canceled prescriptions are significant internal diversion risks. Retail pharmacies should develop policies and procedures for an accounting of will-call and canceled prescriptions and consider developing several reports from their prescription management software to identify any CS medications that have not been picked up from will call within a specific period of time (e.g., 10 days) or have been canceled and returned to stock. Furthermore, organizations should consider interfacing their point-of-sale system with their prescription management software and develop a report to reconcile processed prescriptions with prescriptions in will call and sold.
Fraudulent prescriptions also pose a significant risk for diversion in the CS supply chain. Retail pharmacies should utilize a variety of diversion prevention and monitoring tools when reviewing CS prescriptions, including internal pharmacy documentation and dispensing records, third-party utilization reviews, and prescription drug monitoring programs, if applicable. Retail pharmacies should attempt to receive electronic CS prescriptions when possible. If hard-copy prescriptions are accepted, retail pharmacies should develop a system to document which employee received the CS prescription at prescription intake and validate that it was not introduced into the pharmacy dispensing system for fraudulent purposes. The same system should be utilized to document which employee processed the CS prescription. Finally, the CS prescriptions should be filed sequentially, and retail pharmacies should consider developing a system to audit hard-copy prescriptions for documentation of chain of custody from employee to patient, such as signature of receipt.
Personnel should keep a complete and accurate written or electronic perpetual inventory record for the receipt (CSOS and DEA Form 222) and disposition of all Schedule II medications, filed in sequential order. The perpetual inventory should be updated each time a Schedule II CS medication is received and should be verified by two employees, one of whom needs to be a licensed provider. Furthermore, the same sign-off process in the perpetual inventory log should occur with each fill of a Schedule II CS, when possible. Retail pharmacies should utilize labels from the prescription management software to record the quantity filled in the perpetual inventory log. Retail pharmacies should also consider implementing a system for partial fills of Schedule II CS, as they pose a significant risk for diversion. Schedule II CS medications should be audited each month to ensure correct counts and that the perpetual log has been signed off by two employees. All records, including but not limited to prescriptions, DEA Form 222s, CSOS receiving documents, perpetual inventory logs, and discrepancy reports, should be kept for a specified time as determined by the state board of pharmacy. When discrepancies are identified, they should be evaluated by a third party, such as CSDPP or internal auditing personnel.
Other areas providing CS prescriptions or drugs directly to patients (e.g., emergency departments, emergency medical services, discharge prescriptions, home infusion) should ensure the chain of custody from preparation to delivery or administration to the patient and wasting, if applicable, including procedures that validate that the chain of custody has been maintained.
Healthcare organizations should develop a framework for integrating CS diversion prevention strategies into a comprehensive CSDPP. With engaged interprofessional leadership and collaboration, organizations can foster a culture of organizational and individual awareness and accountability for CS diversion prevention and response.
ASHP gratefully recognizes the contributions made to these guidelines by the following individuals: Ryan Craynon, Pharm.D.; Kimberly Dove, Pharm.D.; Kimberly New, J.D., B.S.N., RN; Suzanne Shea, M.B.A., B.S.Pharm.; Jamie S. Sinclair, M.S., FASHP; David B. Weetman, M.S., FASHP; and Linda Wieloch, Pharm.D. ASHP gratefully recognizes the following organizations and individuals for reviewing draft versions of these guidelines (review does not imply endorsement): American Academy of Physician Assistants (AAPA); American Pharmacists Association (APhA); American Organization of Nurse Executives (AONE); National Association of Boards of Pharmacy (NABP); Paul J. Barrett, Pharm.D., M.P.A., BCPS, FASHP; Gregg Baron, Pharm.D.; David G. Bowyer, B.S.Pharm., FASHP; Andrew Brown, Pharm.D. candidate; Ryan M. Burke, Pharm.D. (APhA); Helen Calmes, Pharm.D., M.B.A.; Carmen A. Catizone, M.S., D.Ph. (NABP); Jeanne Ezell, D.Ph., M.S., FASHP; Brian Faley, Pharm.D., BCPS; Wesley Franke, Pharm.D.; Steve Hetey, M.S., FASHP; James M. Hoffman, Pharm.D., M.S.; Ralph E. Holbrook, B.S.Pharm., FASHP; Ken Jozefczyk, M.S., FASHP; Alfred Adam L’Altrelli, Pharm.D.; Ronald E. Lay, M.S., FASHP; Lynne Lee, Pharm.D.; Kathryn Clark McKinney, Pharm.D., M.S., BCPS; Wesley D. McMillian, Pharm.D., BCPS, FCCM; JoAnne Myhre, CPhT; Brandon Ordway, Pharm.D., M.S.; Sheetal Patel-House, Pharm.D.; Eric D. Peterson, Ed.M., FACEHP, CCMEP (AAPA); William Puckett, M.S., M.B.A., FASHP; James R. Rinehart, M.S., FASHP; Catherine Shely, Pharm.D., BCPS; Michael Starling, Pharm.D.; Kelsey Stephens, Pharm.D.; Janet Stifter, Ph.D., RN, CPHQ (AONE); Janee B. Whitner Ver Vaet, Pharm.D., BCPS; Danielle Vallandingham, B.S.; Jody Jacobson Wedret, B.S.Pharm., FASHP, FCSHP; Roger Woolf, Pharm.D.; and Amy M. Young, Pharm.D., CCMSCP.
Appendix A Definitions of terms related to diversion prevention
All terms used in these guidelines have the definition set forth in Title 21 United States Code Controlled Substances Act (CSA) (Section 102 of the Act [21 USC 802]) or part 1300 of Title 21 Code of Federal Regulations, except where noted.
Defined in the CSA [CSA §102(2); 21 USC 802(2)] (2), the term refers to the direct application of a controlled substance to the body of a patient or research subject by (a) an individual practitioner (or, in his presence, by his authorized agent), or (b) the patient or research subject at the direction and in the presence of the individual practitioner, whether such application be by injection, inhalation, ingestion, or any other means.
Defined in the DEA regulations [21 CFR 1300.03] but not in the CSA, the term refers to a record showing who has accessed an information technology application and what operations the user performed during a given period.
Automated dispensing system
Defined in DEA regulations [21 CFR 1304.02(g)] but not in the CSA, the term refers to a mechanical system that performs operations or activities, other than compounding or administration, relative to the storage, packaging, counting, labeling, and dispensing of medications and which collects, controls, and maintains all transaction information.
Defined in DEA regulations [21 CFR 1300.03] but not in the CSA, the term refers to authentication based on measurement of the individual’s physical features or repeatable actions where those features or actions are both distinctive to the individual and measurable.
A physical inventory taken by personnel who perform a hands-on count of inventory without access to the quantities currently shown on electronic or other inventory systems. Blind counts are used to assess the integrity of the automated inventory systems. (Source: www.businessdictionary.com/definition/blind-count.html)
Defined in the CSA [CSA §102(10); 21 USC 802(10)], the term refers to the actual, constructive, or attempted transfer of a controlled substance or a listed chemical, whether or not there exists an agency relationship.
Defined in the CSA [CSA §102(10); 21 USC 802(10)] but not in DEA regulations, the term means to deliver a controlled substance to an ultimate user or research subject by, or pursuant to the lawful order of, an individual practitioner, including the prescribing and administering of a controlled substance and the packaging, labeling, or compounding necessary to prepare the substance for delivery. Additionally, the term dispenser, as defined in the CSA [CSA §102(10); 21 USC 802(10)] and DEA regulations [21 CFR 1304.02(c)], means an individual practitioner, institutional individual practitioner, pharmacy, or pharmacist who dispenses a controlled substance.
Defined in the CSA [CSA §102(10); 21 USC 802(10)] but not in DEA regulations, the term means to deliver (other than by administering or dispensing) a controlled substance or a listed chemical. The term distributor means a person who so delivers a controlled substance or a listed chemical.
The term includes any unaccountable loss, theft, use for unintended purposes, or tampering of a drug. For purposes of these guidelines, drug diversion is a medical and legal concept involving the transfer of any legally prescribed drug from the individual for whom it was prescribed to another person for any illicit use, including any deviation that removes a prescription drug from its intended path from the manufacturer to the intended patient.
Refers to an employee, individual practitioner, or contracted worker who provides services within an organization and who has access to controlled substances.
Defined in the CSA [CSA §102(20); 21 USC 802(20)] but not in DEA regulations, the term refers to a physician, dentist, veterinarian, scientific investigator, pharmacy, organization, or other person licensed, registered, or otherwise permitted, by the United States or the jurisdiction in which the individual practitioner practices or does research, to distribute, dispense, conduct research with respect to, administer, or use in teaching or chemical analysis, a controlled substance in the course of professional practice or research.
Long-term care facility
Defined in DEA regulations [21 CFR 1306.02(e)] but not in the CSA, the term refers to a nursing home or a retirement care, mental care, or other facility or institution that provides extended healthcare to resident patients.
Defined in DEA regulations [21 CFR 1300.03] but not in the CSA, the term refers to a secret code, typically a character string (letters, numbers, and other symbols), that a person memorizes and uses to authenticate his identity.
Defined in DEA regulations [21 CFR 1304.02(g)] but not in the CSA, the term refers to any individual licensed by a state to dispense controlled substances and also includes any other person (e.g., pharmacist intern) authorized by a state to dispense controlled substances under the supervision of a pharmacist licensed by that state.
Defined in DEA regulations [21 CFR 1300.01(b)] but not in the CSA, the term refers to an order for medication which is dispensed to or for an ultimate user but does not include an order for medication which is dispensed for immediate administration to the ultimate user (e.g., an order to dispense a drug to a bed patient for immediate administration in a hospital is not a prescription).
Defined in DEA regulations [21 CFR 1304.02(h)] but not in the CSA, the term means that certain records are kept by automatic data-processing systems or other electronic or mechanized recordkeeping systems in such a manner that they can be separated out from all other records in a reasonable time and/or records are kept on which certain items are asterisked, redlined, or in some other manner visually identifiable apart from other items appearing on the records.
Defined in DEA regulations [21 CFR 1306.02(e)] but not in the CSA. The term reverse distribute means to acquire controlled substances from another registrant or law enforcement agent for the purpose of (a) return to the registered manufacturer or another registrant authorized by the manufacturer to accept returns on the manufacturer’s behalf or (b) destruction. A reverse distributor is a person registered with the DEA as a reverse distributor.
A significant diversion is any unaccountable loss of a controlled substance. Some states and local authorities may have specific requirements for what is considered significant. In its 1971 regulation, 21 CFR 1301.74(c), DEA provided the following list of factors to consider when making determinations about whether losses are significant:
The actual quantity of controlled substances lost in relation to the type of business,
The specific controlled substances lost,
Whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals, or whether the loss can be attributed to unique activities that may take place involving the controlled substances,
A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses, and, if known,
Whether the specific controlled substances are likely candidates for diversion, and
Local trends and other indicators of the diversion potential of the missing controlled substance.
Organization Oversight and Accountability
□ The organization establishes a controlled substances (CS) diversion prevention program (CSDPP).
□ The organization establishes an interdisciplinary CSDPP committee to provide leadership and direction for developing policies and procedures for overseeing the CSDPP. A pharmacy representative has a leadership role on the CSDPP committee, and there is a designated diversion officer who coordinates activities of the CSDPP.
□ The diversion officer should have a license and a college degree in pharmacy or nursing, with at least 5 years of healthcare experience; ideally, the diversion officer would be a licensed pharmacist with 10 years or more of experience as a staff or managerial pharmacist and an advanced management degree (e.g., M.H.A. or M.B.A.). The diversion officer should have a thorough understanding of medication management systems and technologies (e.g., automated dispensing devices, medication carts, repackaging systems); CS surveillance and management systems and techniques; federal and state regulatory compliance requirements; and auditing techniques. The diversion officer should be familiar with operations of the pharmacy department (e.g., ordering, receiving, storage, distribution, administration, returns, wasting) as well as other pertinent areas (perioperative, anesthesia, procedure, clinic, research, and retail pharmacy areas). The diversion officer should be able to lead the complex investigatory processes of an interdisciplinary team, which will require strong analytical and communication skills, attention to detail, organization, ability to work independently and collaboratively, and a commitment to healthcare ethics and confidentiality. The diversion officer should have formal training in the processes of conducting a drug diversion investigation and, if performing interviews or interrogation, in those techniques as well. The diversion officer should have the ability to work with local, state, and federal law enforcement organizations during criminal investigations, as well as with state licensing agencies and national accrediting organizations. The diversion officer should have the ability to work with the organization’s human resources department and hospital leadership to develop strong policies to protect employees and mitigate employee diversion risks. Familiarity with the causes, symptoms, recognition, and treatment of drug addiction and human behavioral assessment is desirable, as is a passion for patient safety and protecting the organization from diversion. Diversion officers should be familiar with national, state, and local drug abuse and diversion trends. They should be involved with national, state, and local organizations and efforts to help raise awareness of drug diversion, and attend local, state, and national diversion meetings (e.g., National Association of Drug Diversion Investigators conferences).
□ The CSDPP committee
○ Includes representatives from, but not limited to, the following departments: medical, anesthesia, pharmacy, nursing, security, human resources, compliance, risk management, administration, legal, communications, information technology, and employee health;
○ Establishes a charter that includes membership composition, roles, responsibilities, reporting structure, and meeting frequency; and
○ Is proactive in its prevention efforts and actively addresses prevention control, diversion detection, incident investigation, and reporting procedures (e.g., minutes that document monitoring trend reports, quality-improvement efforts and outcomes of those efforts, compliance with existing procedures, and reviews of internal and external audits and action plans).
□ The functions of the CSDPP committee are integrated with existing compliance management programs, and the committee reports at least quarterly directly to the senior leadership of the organization.
□ A diversion response team that can rapidly and effectively respond to suspected incidents is established, with notifications tiered based on the stage of investigation.
□ The diversion response team members conduct diversion risk rounds.c Diversion risk rounds involve observation of areas where controlled medications are received, stored, or utilized, as well as interaction with staff and patients in these locations. The objectives are to assess security, monitor compliance with regulations and institutional policy, and initiate process improvement where warranted.
□ Established policies and procedures reflect federal and state regulatory requirements.
□ Policies and procedures build in closed-loop chain of custody with individual accountability that is readily auditable.
□ CS diversion incidents are collated, reviewed, and analyzed to identify further opportunities for improvement in existing systems.
□ Surveillance data are trended and shared with the CSDPP committee to review on at least a quarterly basis. Trended information is acted upon, corrective actions are implemented, and resolution of the identified issue is verified.
□ The CSDPP conducts failure mode and effects analysis to identify potential points of risk and develop prevention strategies.
□ The CSDPP ensures that policies and procedure reflect a segregation of duties where there is overlapping processes for diversion risk.
□ The organization identifies high-risk areas where CS diversion could occur and implements specialized controls and more focused surveillance for these areas when warranted.
□ Drug Enforcement Administration (DEA) licenses are current, and power-of-attorney designees are reevaluated at least annually.
□ The organization collaborates and cooperates with key external stakeholders, including local DEA officials, local law enforcement, wholesalers, technology vendors, state licensure boards, and contract pharmacy services.
Human Resources Management (Staff Education, Expectations, Culture, Support)
□ The organization implements a process to remove a healthcare worker (HCW) suspected of being impaired from delivering patient care and to prevent further access to CS either pending investigation or after a confirmed diversion or policy breach.
□ The organization has a clearly defined full disclosure policy and process to communicate to patients and families that are affected by CS prevention diversion.
□ The organization conducts pre-employment background checks for HCWs who have access to CS in the course of their job responsibilities.
□ When HCWs with access to CS are suspended, terminated, or otherwise separated, the pharmacy and designated system administrator are notified immediately so access to CS can be removed promptly, within a time frame defined by the organization.
□ Known diverters who are licensed or registered are reported to the appropriate licensing or registration board as required by state law.
□ A comprehensive human resources and occupational health approach to support the CSDPP at a minimum consists of (a) a written employee and provider substance abuse policy; (b) an HCW education and awareness program; (c) a supervisor training program; (d) an employee and provider assistance program; (e) peer support and systems (e.g., pharmacist recovery network); (f) requirements for drug testing, including a for-cause policy for drug testing; (g) return-to-work policies for HCWs; and (h) sanctions for performance and diversion violations.
□ The CSDPP ensures that training of all staff with access to CS is mandatory and occurs annually or when there is a significant change in policies or procedures.
□ Pharmacists participate in or contribute to the development of substance abuse prevention and assistance programs within the organization.
□ The organization’s senior leadership emphasizes the importance of reporting signs of a potentially impaired HCW or suspected CS diversion and its potential impact on patient care, including ramifications for failure to report; communicates the expectation that staff speak up when they become aware of or suspect an issue related to CS diversion; and ensures and communicates that staff will be protected from retaliation if they report a suspected CS diversion or impaired HCW.
□ The organization establishes and communicates ways for staff to speak up anonymously (e.g., telephone hotline, paper or electronic submission).
□ All HCWs receive annual education in diversion prevention and substance abuse and diversion awareness (signs and behavior patterns and symptoms of impairment) and reporting; and managers receive training in signs, symptoms, and behavior alerts, what to do when they suspect an HCW may be impaired, and managing HCWs in recovery.
□ The organization establishes a process to support recovery and peer assistance programs for those who have diverted for an active substance abuse problem.
□ Drug testing for cause is permitted, and, as required by licensing boards or other employment contracts, organizations implement reliable testing and validation for drug screening.
□ The organization establishes behavioral standards and norms among all employees that discourage the abuse of CS.
□ An ongoing CS diversion education program is in place to promote the safe handling of CS and awareness of medication diversion. Education on medication diversion and CS policies and procedures is required before authorizing HCW access to CS.
□ The organization develops and enforces sanctions for CSDPP policy and procedure violations.
□ If provider services are contracted, contracts provide that all contracted workers receive education regarding CS and that the contracted company notify the organization immediately if there is disciplinary action against an employee or if an employee is removed because of an impairment issue.
Automation and Technology
□ An interdisciplinary team that includes pharmacy representation participates in the selection and implementation of all medication-related automated systems (e.g., surveillance software) and technology (e.g., automated dispensing devices, syringe and infusion pumps, security devices) to ensure they support CS diversion control, surveillance, and auditing and meet legal, regulatory, and functionality requirements.
□ Pharmacy representatives have an integral role in the selection and implementation of all medication-related automated systems and technology.
□ The organization works proactively with vendors to ensure there is adequate training and implementation testing before installing or upgrading new technology equipment or software.
□ Changes in or upgrades to existing technology are reviewed by key stakeholders, including pharmacy representatives, to assess potential impacts on systems of CS control, surveillance, and auditing, and changes or upgrades are tested and vetted to ensure implementation meets legal, regulatory, and functionality requirements.
□ Records generated from technology solutions are readily retrievable and contain information required to conduct investigations and fulfill investigator requests.
□ Reporting capability is tested to ensure that records with complete and actionable information are readily retrievable.
□ Staff is adequately trained regarding their roles and responsibilities in the use of automation and technology, and competency is assessed when an HCW is on boarded to a new position or responsibilities, annually, or when there is a relevant change to existing technology.
□ Systems are implemented for areas with high-volume use of CS (e.g., surgery or anesthesia areas, central pharmacy).
□ Access to CS in automated dispensing devices is limited to authorized individuals, and there is a process in place to immediately add or rescind access privileges (e.g., suspected diverters can be removed immediately, other users [e.g., terminated HCWs] removed within 24 hours, and temporary HCWs added as necessary).
□ Administrative privileges that allow staff to add or delete automated dispensing device users are limited to as few individuals as possible.
□ Policies and procedures specify that automated dispensing device overrides should be limited only to clearly defined situations. The amount of CS available for dispensing via automated dispensing device override functionality is minimized, and the process is directed by a comprehensive policy and review process that includes ensuring use is clinically appropriate, a valid order exists, and there is appropriate documentation in the medical record.
□ The pharmacy department is the party responsible for authorizing access to CS and for adding and removing users to automated dispensing devices. If this authority is delegated to informatics or security personnel, the pharmacy department should still maintain responsibility to oversee the process and ensure that established procedures are followed.
□ Controls are in place to limit lock-out access times, and this access discontinued as soon as possible when patients are transferred or discharged.
□ Automated dispensing device or electronic vault downtime procedures are defined to maintain control, documentation, and accountability of CS.
□ Automated dispensing device admission, transfer, and discharge patient profile information is managed in a timely manner.
Monitoring and Surveillance
□ The CSDPP committee identifies surveillance metrics, responsibility for conducting reviews, and frequency of reviews.
□ The organization, through the CSDPP committee, establishes surveillance requirements, including defining monitoring and surveillance measures, thresholds of variance that require action, reporting frequency, and surveillance procedures, and ensures that all elements are implemented, conducted in a timely manner, investigated, and reported as required.
□ The CSDPP committee provides facility oversight to ensure that established audits for facility-based diversion monitoring are conducted and documented.
□ There is a process defining the escalation of discrepancies that cannot be resolved (“unresolvable discrepancies”) or CS policy and procedure violations that include the director of pharmacy or designated pharmacy manager and other hospital leadership, including the chief executive officer, as appropriate.
□ Surveillance processes are interdisciplinary and touch all aspects of the CS management system, from purchasing to waste and disposal.
□ Self-audits are conducted within areas as well as regularly scheduled audits by individuals external to the area being audited.
□ The organization periodically audits human resources requirements for individuals authorized to handle CS, including
○ Completion of required background checks,
○ Documentation of training and competency requirements for authorized staff,
○ Compliance with random drug testing requirements, and
○ Compliance with licensure board reporting and rehabilitation program requirements.
□ Drug purchase history is monitored through regularly scheduled audits to identify diversion through variations or changes in volume or pattern.
○ CS purchase invoices are compared to CS purchase orders and receipt into the pharmacy’s perpetual inventory.
○ Invoices are reconciled to statements or wholesale purchase history reports to detect missing invoices.
○ A process is in place to identify unusual peaks in quantity or frequency of CS purchases (e.g., quarterly review of purchases over the prior 12–24 months).
○ Wholesaler is able to flag unusual peaks in quantity or frequency of CS purchased.
□ A perpetual inventory of all CS is maintained and verified on a regular basis, consistent with the control system used (e.g., inventory managed with automated dispensing devices with closed compartments and unit-of-use access limitations versus manual inventory).
○ CS counts from automated dispensing devices are verified (blind count) each time a CS drawer is accessed, and a complete inventory for CS in automated dispensing devices is conducted weekly by two authorized HCWs.
○ Deliveries, replenishment, and stocking of CS in patient care areas will be done by authorized pharmacy personnel and require an auditable verification of delivery and receipt.
○ CS inventory in the pharmacy narcotic vault is counted at least monthly.
○ Outside pharmacy areas, CS storage areas in which CS are not managed through automated dispensing devices are inventoried at each shift change by two authorized HCWs.
○ A biennial physical inventory of all CS is completed and documented per DEA requirements (or per state requirements, whichever is the stricter interpretation).
□ Automated dispensing device reports are routinely monitored to ensure overrides occur only as permitted by policies and procedures.
□ Automated dispensing device override reports are reviewed daily to ensure an order exists during the time the medication was accessed from the automated dispensing device, and corresponding documentation is in the medication administration record (MAR).
□ Reports match narcotic vault transactions with receipt into automated dispensing device and/or paper inventory record with signature of receipt.
□ Diversion monitoring software is implemented to support surveillance activities.
□ A person is dedicated to surveillance monitoring and is accountable for optimizing implementation and functionality of diversion monitoring software. Other disciplines (e.g., nursing quality, anesthesia providers) are actively involved in surveillance audits and assist with evaluation of trends and incident investigation.
□ Reports that monitor CS use in patient care areas are reviewed at least monthly by pharmacy and patient care managers as defined by the organization. The organization has a process to generate CS trend data and reports:
○ Tracking and trending of patient care usage.
○ Reports compare automated dispensing device activity with the prescriber order and MAR.
○ The MAR is reviewed for amount and quantity administered compared to what other caregivers administer on subsequent shifts (without patient change in condition).
○ Automated dispensing device CS activity is compared to peers with similar staffing responsibilities and appointments.
○ Transaction activity (e.g., inventory abnormalities, removal of quantities greater than prescribed dose, cancellations, returns, waste) is compared with peers.
○ Transactions are reviewed after a patient is discharged or transferred to another unit.
□ Prescribing practices are reviewed for unusual trends or patterns, such as variance in prescribing compared to peers.
□ Patient response to medication (e.g., pain management) is also evaluated against medication administration, documentation of response, and patient interview.
□ Nursing management conducts random patient interviews to verify that patients received pain medication and that the medication adequately controlled pain and also compares responses to nursing patient assessment notes and MAR.
□ Nursing management integrates routine auditing and surveillance activities into core daily, weekly, or monthly responsibilities, including staff education regarding signs of diversion, symptoms of substance abuse, and diversion reporting procedures; review of nursing removal, return, and wasting records; development, implementation, and monitoring of procedures for witnessing CS-related transactions; and investigation and reporting of suspected diversion in accordance with organization procedures.
□ CS storage inventory transactions are routinely compared with the MAR (e.g., anesthesia record, sedation record, electronic MAR) to ensure appropriate documentation of administration and waste.
□ Anesthesia CS audits are performed on a regularly scheduled basis, as determined by the process for managing CS for anesthesia, identified risk points, and previous events.
□ CS discrepancies are reported to the supervisor in charge, who reviews and attempts to resolves the discrepancy no later than the end of the work shift. Discrepancies that cannot be resolved (unresolvable discrepancies) are reported immediately to the pharmacy department and are jointly reviewed by pharmacy and patient care leadership, with resolution within 24 hours.
□ The supervising or other designated pharmacist is notified of unresolvable discrepancies in automated dispensing devices and supports the reconciliation investigation; a pharmacist has responsibility for investigating the discrepancy, even when a pharmacy technician assists with these duties.
□ A trend of poor documentation practices by an HCW is reviewed by his or her immediate supervisor (e.g., nursing or pharmacy manager, department chair) for possible diversion.
□ There is a procedure for random testing of waste from all high-risk, high-volume areas, including areas for pharmacy sterile products preparation, anesthesia administration, and surgery.
□ CS dispensed in high-risk settings (e.g., for operating room cases or procedures) are reconciled by pharmacy against what CS were documented as administered or wasted.
Investigation and Reporting of Suspected Diversion
□ The organization creates and implements a standard process to investigate discrepancies that are not resolved (unresolvable discrepancies) or other discovered or suspected diversions.
□ Any unresolvable discrepancy is considered a possible diversion and escalated to investigation, and notifications occur as defined by the CSDPP.
□ A process is in place to report and respond to suspected diversions and prompt an immediate investigation:
○ A 24 hours-per-day/7 days-per-week medication diversion pager or phone number is available to report (anonymously, if desired) suspected medication diversion.
○ An interdisciplinary drug diversion response team is in place to provide consultation, direction, and oversight for suspected diversion incidents.
○ Designated team members external to the area under investigation are also involved to ensure the impartiality of the investigation of incident.
○ A standardized process exists for interviewing suspected CS diverters.
○ Guidelines are in place for the handling of suspected impaired HCWs and drug testing, including guidance when for-cause testing may be initiated.
□ A defined process is in place for the internal and external reporting of medication diversion incidents.
□ The pharmacy director or his or her designee and diversion officer (if different) are notified immediately of any suspected diversion within the organization, participate in all active investigations regarding CS diversion, and are informed of the outcomes of all investigations.
□ There are guidelines for determining whether a CS loss is considered significant, which include factors such as
○ Quantity of CS lost in relation to the type of business.
○ The specific type(s) of CS lost.
○ Whether the loss can be associated to access by specific individuals or can be attributed to unique activities.
○ A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses.
○ Whether the specific CS are likely candidates for diversion.
○ Local trends and other indicators of the diversion potential.
□ There are guidelines for engaging others internal to the organization, such as the risk management, legal, and human resources departments, as well as leadership levels of medical staff and administration. Guidelines specify who will coordinate the investigation, including communications to appropriate team members, conducting the investigation, and coordinating internal and external reporting.
□ If the organization becomes aware of an arrest of an HCW for illicit use of CS, the organization immediately conducts an investigation of the HCW’s transactions to assess whether diversion has occurred. The organization assesses whether to suspend, transfer, terminate, or take other action (e.g., remove access to CS) or other sanctions against the HCW. The organization immediately removes access privileges to CS if diversion is suspected, until the investigation is complete and a determination of diversion or other risks to patient care is made.
□ The organization establishes guidelines for engaging external entities, such as DEA, licensure boards, laboratories (for testing), and local law enforcement. Guidelines specify who is required to be notified, when notifications take place, who is responsible for contacting the agency/designated representative, and the time frame and circumstances for notification.
□ The organization fulfills all reporting requirements for diversion or other unaccountable loss of CS in accordance with laws and regulations.
○ Investigations are conducted as thoroughly and completely as possible; reporting occurs when it is determined that the discrepancy is unresolved or that there has been a known theft or diversion
○ Organizational policy defines when a DEA Form 106 should be completed with discrepancies that remain ultimately unresolved. There are clear responsibilities for completion of a DEA Form 106 for a theft or significant loss, who is to be notified, and when.
□ For significant diversions, a quality-improvement review is initiated, including a root cause analysis and recommendations to prevent future occurrences.
□ Representative(s) from the area where there is a suspected diversion are engaged in the investigation and refinement of prevention strategies.
□ Proactive, systemic analyses of CS processes are conducted, such as a failure mode and effects analysis, to identify risk points and take action to improve diversion prevention practices.
□ There are guidelines for engaging the media and managing external public relations. Guidelines specify when to notify the media, what internal communications are required, and who is responsible for approving media communications and contacting the media representative.
Chain of Custody
□ Authorized HCWs verify dispensing and receipt of CS. In areas without automated dispensing device storage, the HCW delivering and the HCW receiving CS both cosign documentation of receipt, and the CS is secured immediately.d
□ When using an automated dispensing device for dispensing and storage of CS, transactions should be tracked and reconciled electronically.
□ Sending CS via a pneumatic tube system is not recommended; if employed, delivery requires a secure transaction function (e.g., not a generic passcode when CS is received in a patient care area).
□ Persons transporting CS (e.g., couriers) are trained and competent in relevant organizational policies and procedures.
□ When using a courier for CS transport, procedures and documentation are in place to ensure receipt of CS at the final destination. CS delivery to areas with automated dispensing devices requires co-signature for delivery and return.
□ Hand-offs during a patient procedure are avoided, but in the event a hand-off is required, there are procedures to document the chain of custody provider transfer of CS during a case (e.g., preparation of case trays, for break coverage or change of shift).
□ Secure, lockable, and tamper-evident delivery containers (e.g., carts, trays, boxes) are used to deliver CS. Packaging does not make the contents apparent (e.g., opaque containers).
□ When used, locking mechanism on transport containers should be traceable (e.g., plastic tie locks with a unique numerical identifier).
□ There is a process to ensure that chain of custody is maintained when transferring CS to a laboratory service (internal or external) analyzing products as part of an investigation or random assay process.
□ Dispensing a prescription for CS to patients from patient care areas, such as the emergency department, is not recommended; if such dispensing occurs, chain of custody is documented from the provider to the patient.
□ The organization establishes a procedure for transfer of CS to emergency medical services that complies with federal, state, and local requirements.
Storage and Security (Facilities, Requirements, Inventory Management)
□ CS are securely stored in a locked location (i.e., automated dispensing device, safe, locked cabinet/drawer, refrigerator) accessible only to authorized individuals at all times unless in the direct physical control of an authorized individual. CS not under the direct physical control of an authorized individual are in an area allowing direct observation at all times and where distractions are minimized.
○ Environmental services and other support staff should not have access to central CS storage locations when unattended (e.g., after hours).
○ When used, lock boxes are stored in a secure location when left unattended.
○ Codes for electronic or keypad locks on cabinets or carts are not set at the manufacturer’s default code and are protected with a strong code (e.g., not “1-2-3-4”).
○ Lock-out times for electronic locks on carts (e.g., medication carts, anesthesia carts) containing CS are limited to the narrowest window of time appropriate for the particular setting.
○ There is a procedure to track keys, secure keys after hours, replace lost keys, and change locks, and there is evidence of compliance with those procedures.
○ Storage areas, including medication rooms, have a window to allow visibility within the area. Backpacks, purses, and bags are not allowed in the pharmacy CS area. Surveillance is present in primary CS pharmacy storage and preparation areas (e.g., CS vault).
□ Access to CS storage areas is minimized and limited to authorized staff.
○ When key lock security is used, chain of custody is maintained for keys, and there is a process to secure keys after hours in locations not in continuous operation.
○ There are policies and procedures regarding CS access, including restrictions through assignment, key controls, and use of passwords.
○ At least every 6 months there is a complete assessment of all staff with access privileges to ensure that only those permitted access have access (e.g., authorized HCWs, temporary employees, independent practitioners with privileges).
○ Removal of access occurs in real time as employees are terminated. For auditing purposes, staff termination reports (date and time) are reconciled against date and time of documented removal of access.
○ Patient-specific CS infusions are contained in a secured, locked box utilizing no-port tubing unless under constant surveillance. Keys to these controls are limited and tracked as any keys or lock boxes are.
□ Within pharmacy areas with automated dispensing device vault management, CS inventory verification counts are conducted by two rotating, licensed, or otherwise authorized pharmacy providers monthly. For pharmacies without automated dispensing device vault management, a physical inventory is conducted at least once per month, preferably weekly.
○ Inventory count includes expired and otherwise unusable CS awaiting disposal or transfer to reverse distributor.
○ CS counts done via automated dispensing devices and manual systems are verified by a blind count each time a CS location (e.g., drawer, pocket, refrigerator) is accessed.
□ Automated dispensing device technology is utilized in areas with a high volume of CS use, including the pharmacy, anesthesia and surgery areas, high-volume clinics, and outpatient procedure areas.
□ User identification and biometric authentication are used rather than passwords. When biometrics cannot be used, password security on automated dispensing devices follows institutional policy and standards and includes requirements for password complexity and frequent changes. For manual access to CS, signature and initial logs recording receipt and disposition are maintained as appropriate. Any HCW receiving, transferring, or dispensing CS will be able to provide photo identification upon request.
□ Camera surveillance is considered for high-risk areas (e.g., receiving areas, central pharmacy vault location, approved waste receptacles), remote areas, areas where electronic or biometric access is not available, and when for-cause surveillance is required to support an investigation.
□ Procedures are implemented to secure storage of DEA forms, and access to forms is limited to authorized individuals.
○ There are procedures and documentation (e.g., a log book) for tracking the receipt and filling of DEA Form 222.
○ Blank DEA Form 222s are listed consecutively on a log documenting the disposition of each form.
○ The DEA Form 222 log is stored separately from unused DEA forms.
○ DEA Form 222s are not presigned.
□ Procedures are implemented to secure prescription pads and paper, and access is limited to authorized individuals.
○ Prescription blanks and paper for printing prescriptions are dispensed per patient rather than the entire prescription pad.
○ There is a method (e.g., numbering system) to allow for tracking of individual prescriptions.
□ Procedures are established that ensure controls are in place to secure CS and prevent diversion in the rare cases in which CS is brought into the organization by patients.
○ CS should only be accepted when they are to be administered to the patient pursuant to an authorized prescriber’s order.
○ Documentation of patient’s CS, quantity inventoried, and signatures of two verifying HCWs should be recorded in the medical record upon receipt and at discharge.
○ Patient’s own CS are secured and tracked via a perpetual inventory record, and any remaining CS is returned to the patient upon discharge.
○ The patient or patient’s representative signs that he or she has received the CS, noting the quantity.
○ CS that cannot be returned to home and are not to be administered to the patient are to be inventoried and removed from patient care areas with appropriate chain of custody documentation and stored securely per organization policies, which include procedures for returning CS to the patient or authorized persons and management and final disposition of CS if not returned to patient or authorized persons.
○ Organizations consider providing, in collaboration with local and state authorities, a public receptacle for disposal of CS by patients.
○ If patients bring illicit substances into the organization, procedures address notification of the local DEA office and law enforcement, as required by law, and as advised by those authorities.
Internal Pharmacy Controls
□ All CS are procured from the pharmacy. If other departments or individuals are authorized to procure CS, there are checks and balances established to ensure the same policies and procedures are consistently followed throughout the organization.
□ The number of people authorized to order CS is limited to individuals authorized and defined by policy.
□ Electronic CS ordering system (CSOS) is used and CSOS order files are backed up to an organization-based system to ensure that archived files are readily retrievable by designated personnel.
□ If DEA Form 222s are used, they are secured, and the DEA Form 222 accountability and control log includes
○ DEA order form number
○ Date the form was received from the DEA
○ Date the form was issued for use
○ The company the form was issued to
○ The initials (if the organization uses a signature/initial log) or signature of user
□ Separation of duties exists between the ordering and receipt of CS.
○ Two authorized individuals count and sign (two signatures) for CS upon receipt (packing slip) and confirm that what is received matches what was ordered and invoiced (purchase order and invoice).
○ A pharmacist reconciles CS received against what is indicated on the delivery ticket or invoice and documents receipt as required; the documents will be signed or initialed. CS purchase invoices are compared to CS orders and receipt into the pharmacy’s perpetual inventory. Since the invoice–receipt pair may both be removed with CS diversion, invoices also are reconciled to statements or wholesale purchase history reports to detect missing invoices. Staff should be cross-trained and rotated through functions related to procurement and prepackaging.
○ Automated vault technology is utilized in the central pharmacy main storage location.
○ If the HCW who provides the second count at check-in is not a pharmacy employee (e.g., at a small organization where only one pharmacy employee is available), the designated HCWs receive appropriate training.
○ CSOS orders are acknowledged as received within 7 days of placing the order.
○ CS inventory levels are routinely reviewed, and orders are based on usage to minimize excess stock.
□ There are processes to track and reconcile CS products when preparation is outsourced to a third-party vendor.
□ There are procedures for interorganization transfer and transport of CS, including distribution from or to a central distribution hub within an organization.
□ There are procedures for transfer of CS between pharmacies.
□ The organization establishes a policy that discrepancies in the procurement process will be documented and brought to the attention of the director of pharmacy or designated pharmacy manager.
Preparation and dispensing controls
□ A perpetual inventory is maintained and a blind count process is used when adding or removing CS from a pharmacy inventory location.
□ Access to CS inventory is limited, with controls to identify who accessed the inventory, when the inventory was accessed, and what changes were made to the inventory.
□ Effective access controls are in place to ensure the integrity of the inventory and provide for accurate, timely surveillance.
□ To minimize opportunities for CS diversion during repackaging, CS are purchased and dispensed in unit dose packaging whenever possible. There are diversion controls in place when CS are repackaged by pharmacy personnel, including separation of duties.
□ Automated dispensing device technology is utilized in patient care areas for the distribution and accountability of CS.
□ In patient care areas, automated dispensing device–managed CS counts are verified by a blind count each time a CS drawer/pocket/cabinet is accessed (unless unit-of-use dispensing technology is employed).
□ In patient care areas, CS managed through automated dispensing devices are manually inventoried by two authorized HCWs if a blind count has not been performed within one week.
□ In patient care areas, CS not managed through automated dispensing devices are manually inventoried by two authorized HCWs every shift.
□ CS managed through automated dispensing devices are stored in a location with single pocket or unit of use access when possible.
□ Barcode-scanning is utilized when replenishing automated dispensing devices.
□ When dispensing, removal from the pharmacy inventory is matched to the refill transaction on the patient care unit to validate that CS reach their destination.
□ CS returned from nursing units to the return bin of the automated dispensing device or to the pharmacy are matched to the CS received by the pharmacy and documented in the perpetual inventory or a return to active inventory transaction on the automated dispensing device.
□ Returns from the patient care and procedural areas (e.g., emptying a return bin) have an auditable verification of return. Returns are inspected for integrity.
Prescribing and Administration
□ A valid order from an authorized prescriber exists for all CS administered, and the number of CS allowed via automated dispensing device override status is minimized.
□ There is a process to identify and verify authorized prescribers within either an electronic or manual ordering system. There is also a process to identify and verify authorized prescribers and prescriptions written by medical residents or other providers who are authorized to prescribe CS under the organization’s DEA registration (e.g., use of a suffix).
□ Pharmacists clarify any orders for which prescriber identity is uncertain or other factors create doubt about the legitimacy of the prescription or order.
□ Oral orders for CS entered into the medical record are reviewed for appropriateness and accuracy by the ordering prescriber before cosigning orders.
□ Prescriptions or orders for CS are reevaluated regularly (e.g., through use of automatic stop reminders, by discontinuing and reordering CS per organizational policy when patients transfer to a different level of care). Medical staff, in coordination and consultation with the pharmacy department, develops and implements an automatic stop-order system for CS when there is not a specific time or number of doses prescribed.
□ Organization policy prohibits authorized prescribers prescribing for themselves or an immediate family member.
□ The organization assesses lock-out times for automated dispensing devices and duration for temporary access, including appropriate number and units of automated dispensing devices for which each HCW is granted access.
□ CS are retrieved from inventory as close to the time of administration as possible. CS retrieved for a patient is the package size equivalent to, or closest available to, the dose to be administered.
□ When being administered to a patient, CS infusions are secured in locked infusion pumps.
□ All CS drawn up into syringes, if not immediately administered, are labeled per organizational policy, and the initials of the HCW who drew up the drug are written on the label. Syringes are kept under the direct control of the person preparing the syringes until administration to the patient, and the initials on prepared syringes are verified immediately before administration to ensure that the syringe has not been switched. Generally, only single doses are drawn up into a syringe. When sequential doses are required from a single syringe, there is a method to track the dose ordered versus the dose administered.
□ In areas in which CS are not managed through automated dispensing devices, CS administration records (CSARs) are accurate and include the following information:
○ Date and time administered
○ Medication name
○ Medication strength
○ Dosage form
○ Dose administered
○ Signature of the HCW who administered the dose
○ Amount wasted (if applicable), with cosignature
○ Proof of count verification per shift
○ Signature of HCW who transferred the balance forward when transcribing to another CSAR.
Returns, Waste, and Disposal
□ CS are stocked in as ready-to-use form as possible (e.g., avoiding the use of multidose vials) and in the lowest commercially available units frequently prescribed to patients. Inventory is routinely evaluated for opportunities to reduce the need to waste.
□ Procedures require that CS be wasted immediately or as close to the time of administration as possible; there is an established timeframe allowed per policy.
□ The wasting of all CS requires an independent witness and documentation, except in situations in which waste is being returned to the pharmacy for assay and wasting.
□ An individual witnessing CS wasting verifies that the volume and amount being wasted match the documentation and physically watches the medication being wasted per policy for safe disposal and in a manner that the CS is not retrievable.
□ There is a procedure for wasting fentanyl transdermal patches according to Food and Drug Administration or state-specific guidelines in a manner that renders the fentanyl irretrievable or otherwise deactivated before disposal.d
□ Pharmaceutical waste containers render CS unrecoverable, irretrievable, and unusable. Containers and their keys are secured, and a process for waste removal and disposal that ensures that chain of custody controls are maintained is implemented.d
□ Potentially reusable products issued from automated dispensing devices are returned to a secure return bin or pocket and not to the original automated dispensing device pocket, and these returns are witnessed and have an auditable verification of return. Returns are inspected for integrity.
□ Empty CS containers are discarded in limited-access waste containers that render the waste irretrievable, and waste procedures comply with organizational procedures for waste management.
□ Expired or otherwise unusable CS are clearly identified as such and stored in a location separate from other medications. They are properly accounted for with a perpetual inventory list that is regularly verified, as is other CS inventory within the pharmacy, and the inventory is monitored until return via reverse distributor or destruction and disposal in accordance with legal requirements. The frequency of returns and destruction ensures that inventory is not allowed to accumulate, but returns and destruction are done at least quarterly.
□ Documentation provided by the reverse distributor is verified and corresponds with the pharmacy perpetual inventory record of expired and unusable CS before the drugs leave the pharmacy.
□ DEA registrant or his or her designee assists with all phases of transfer of CS to a reverse distributor or hazardous waste disposal company.
□ Items returned via reverse distribution are reconciled with the reverse distribution log of CS.
□ If the inventory quantities are double-counted separately by the reverse distributor, these recorded quantities should be reviewed and reconciled with the pharmacy inventory list before the medications leave the pharmacy.
Special Considerations for Retail Settings
□ There are physical access controls, such as secured storage cabinets only accessible by badge or biometric access, to limit and track access by personnel.
□ The organization has security measures in place (e.g., cameras) to monitor theft and provide an avenue for discrepancies to be resolved in a timely manner.
□ The organization has systems in place for documentation and monitoring of CS inventory adjustments made by pharmacy employees, CS prescriptions cancelled and returned to stock, and CS prescriptions left at will call past 10 days from processing.
□ The pharmacy’s point-of-sale system is interfaced with prescription management software and has developed reports to identify discrepancies.
□ The pharmacy has developed a report or auditing process to compare CS purchases with utilization to identify discrepancies and trends.
□ The pharmacy has a system for accepting hard-copy CS prescriptions that provides documentation of employee chain of custody and files CS prescriptions sequentially.
□ The pharmacy has a system in place to audit documentation of employee chain of custody.
□ The pharmacy maintains a perpetual inventory of Schedule II CS that is maintained and audited at least monthly.
□ The pharmacy utilizes labels from prescription management software in the perpetual inventory log to identify the quantity of Schedule II CS filled.
□ The pharmacy has established procedures for managing and documenting partial fills of CS.
↵a This implementation guidance includes recommendations reprinted with permission from the following: Minnesota Hospital Association’s Road Map to Controlled Substance Diversion Prevention 2.0 (www.mnhospitals.org/Portals/0/Documents/ptsafety/diversion/Road%20Map%20to%20Controlled%20Substance%20Diversion%20Prevention%202.0.pdf), the California Hospital Association Medication Safety Collaborative Committee’s Reducing controlled substances diversion in hospitals (www.chpso.org/sites/main/files/file-attachments/controlled_substance_diversion.pdf), and Berge KH, Dillon KR, Sikkink KM et al. Diversion of drugs within health care facilities, a multiple-victim crime: patterns of diversion, scope, consequences, detection, and prevention. Mayo Clin Proc. 2012; 87:674–82.
↵b This implementation guidance does not include all legal requirements and is intended to enhance diversion prevention controls in the health-system setting and should complement policies and procedures required by state, federal, and local authorities as well as accreditation agencies.
↵c New K. Diversion risk rounds: a reality check on your drug-handling policies (2015). www.diversionspecialists.com/wp-content/uploads/Diversion-Risk-Rounds-A-Reality-Check-on-Your-Drug-Handling-Policies.pdf (accessed 2016 Oct 13).
↵d Acute Care ISMP Medication Safety Alert. Partially filled vials and syringes in sharps containers are a key source of drugs for diversion. www.ismp.org/newsletters/acutecare/showarticle.aspx?id=1132 (accessed 2016 Oct 13).
The authors and contributors have declared no potential conflicts of interest.
These guidelines were developed by an expert panel of the ASHP Section of Pharmacy Practice Managers and approved by the ASHP Board of Directors on October 28, 2016.
- Copyright © 2017 by the American Society of Health-System Pharmacists, Inc. All rights reserved.