Practical Steps to Address Drug Diversion and Abuse During the Pandemic

​SHRM has partnered with Security Management Magazine to bring you relevant articles on key workplace topics and strategies. 

Two Chicago pharmacy technicians stole more than 56,000 tablets of hydrocodone—an opioid painkiller—over a 26-month period from 2015 to 2017. The technicians manipulated the pharmacy's inventory system, falsifying records to make it look like the hydrocodone tablets either had not been received from the distributor or had already been dispensed to patients.

The two techs sold the tablets on the black market for approximately $10,800, according to prosecutors. Both technicians pled guilty to one count of conspiracy to possess a controlled substance with the intent to deliver and were sentenced to between one and five years in federal prison.

"When trusted pharmacy employees illegally divert powerful and addictive pain medications for misuse, they put individuals and their families at increased risk for drug dependence and overdose," said Robert J. Bell, special agent in charge of the U.S. Drug Enforcement Administration's Chicago Field Division, in a news release.

Today, in the face of a global pandemic and economic recession, profiting from drug diversion may become more tempting than ever. Increased regulatory and legal risks, the opioid epidemic and an evolving drug abuse landscape have also made drug diversion and loss prevention a higher priority in the healthcare system than ever before.

Drug diversion programs are designed to prevent the diverting of legally prescribed drugs from their intended medical use to any illicit use. According to the U.S. Department of Justice National Drug Intelligence Center (NDIC), the estimated cost of diversion to public and private medical insurers is more than $72 billion per year.

It is likely that future U.S. government enforcement activities will focus on the responsibility of organizations to prevent drug diversion. If that occurs, those organizations would be liable for the diversion. In anticipation of this shift, best practices have evolved to include a diversion enterprise management emphasis that encompasses a multidisciplinary team approach.

Drug diversion regulatory and legal risks have escalated over the past four years, with a series of sanctions and civil proceedings impacting drug diversion control programs.

One of the high-profile sanctions occurred in August 2018, when the U.S. Department of Justice (DOJ) announced a record $4.3 million settlement with the University of Michigan Health Care System in which the hospital also agreed to correct "system-wide" violations of tracking controlled medicines.

The U.S. Drug Enforcement Administration (DEA) began its extensive audit of the university following two tragic incidents involving a nurse and an anesthesiologist, both of whom overdosed on drugs intended for patients. The U.S. attorney who announced the action noted that the hospital has "an obligation to its patients, to its employees and to the public to responsibly control its drug inventory."

The risk to patients can be tremendous. In one incident in Colorado, pain medication in the syringes used during surgeries was stolen, injected by a person dependent on opioids, and replaced with saline. Following an investigation, police charged a surgical technician with the thefts. He was found guilty and sentenced to more than six years in prison. The hospital sent notices to more than 3,000 patients that they may have been infected with hepatitis B, hepatitis C and HIV during their medical procedure at the hospital.

On the legal front, more than 900 U.S. state, local and tribal governments have a pending suit in U.S. District Court in the Northern District of Ohio against wholesale distributors and manufacturers of opioid pain medications, seeking damages sustained from the opioid epidemic. The suit alleges these companies recklessly marketed prescription painkillers while downplaying the dangers of addiction and death. Some legal analysts predict an eventual settlement could exceed $1 billion.

In August 2019, an Oklahoma judge ruled that drug maker Johnson & Johnson deceptively marketed painkillers, helping to spark the state's opioid crisis—which claimed the lives of more than 6,000 people in the state. The case was hailed as the first to hold a pharmaceutical company responsible for the epidemic, and the company was ordered to pay $572 million.

The pressures on diversion programs also come directly from America's use of opioid pain medications, which grew exponentially between 2000 and 2019. Some of this growth was due to legitimate prescription use, but a portion of it was also due to abuse of opioids. U.S. National Institutes of Health (NIH) data showed that overdose deaths from commonly prescribed opioids during this period rose from 1.3 deaths per 100,000 people to 5 deaths per 100,000. According to the U.S. Centers for Disease Control and Prevention (CDC), in 2018, more than 46,000 Americans died from opioid overdoses. That translates to approximately 130 deaths per day. According to the CDC, overdose deaths involving prescription opioids were more than four times higher in 2018 than in 1999.

In 2017, the NIH National Survey on Drug Use and Health revealed an estimated 2 million Americans misused prescription pain relievers for the first time within the previous year. The CDC found that from 2002 to 2010, there was a 74 percent increase in chronic nonmedical use of opioid pain medications, and 2018 CDC data showed that opioid prescribing rates continue to be high in certain areas of the United States—some counties have opioid prescription rates six times higher than the national average.

The United States is not alone in this crisis: Canada experienced more than 10,000 opioid-related deaths between January 2016 and September 2018.

Opioids are a class of drug with a high long-term dependency risk profile. According to medical and drug abuse treatment professionals, opioid dependency is one of the most difficult addictions to beat, and the struggle can last a lifetime. (See "A Constellation of Challenges," Security Management, November 2019.)

An ever-evolving drug abuse landscape in the United States and other countries means there are additional drug diversion challenges beyond depressants (a type of drug that includes opioids). Abuse of stimulants—which include methamphetamine and cocaine—is also on the rise. In 2020, U.S. law enforcement reported unprecedented record seizures of methamphetamine along the U.S. border with Mexico. The DEA reported increases across the United States in methamphetamine purity and decreases in price. Both of these are indicators of increased supply. The CDC has also reported an increase in methamphetamine overdose deaths.

The Canadian Centre on Substance Use and Addiction reports that methamphetamine availability has rapidly increased in Canada. The United Nations Office on Drugs and Crime (UNODC) reported in May 2020 that the price of methamphetamine has dropped to the lowest level in a decade as the supply has surged.

"While the world has shifted its attention to the COVID-19 pandemic, all indications are that production and trafficking of synthetic drugs and chemicals continue at record levels in the region," the UNODC noted.

Meanwhile, the European Monitoring Centre for Drugs and Drug Addiction reported mixed methamphetamine rates, with prices dropping significantly in The Netherlands, Sweden, Hungary, Cyprus and Austria, while increasing in Croatia, Denmark, Finland, Poland and Romania.

A 2016 European Union study on opioids found that there was a high rate of prescription pain reliever abuse in the EU, although not as high as in the United States—20 percent for those aged 12 years and over, compared to between 7 percent and 13 percent in the EU.

In 2020, U.S. law enforcement reported increased seizures of cocaine from South America. Maritime seizures of cocaine shipments by U.S. law enforcement are at a level not seen since the 1980s. Europol reports that cocaine trafficking in Europe has been at historical highs, with much of it entering via maritime freight, primarily from ports in The Netherlands, Belgium and Spain. The signs of increased abuse of stimulants is expected to put pressure on illicit abuse of pharmaceutical stimulants such as Adderall, Dexedrine and Ritalin.

Additionally, societal pressures and health risks associated with the COVID-19 pandemic are heightening drug abuse and drug diversion risks.

COVID-19 and Drug Diversion

Without question, COVID-19 dramatically increased personal stress on healthcare personnel. Many healthcare workers bore the increased burden of fearing they might become a carrier of COVID-19 and transmit it to their families and loved ones.

In addition, healthcare workers assigned to intensive care units reported tremendous emotional burdens of caring for patients dying of the disease with no family or loved ones by their bedsides. A consequence of increased pressures and occupational stress is greater risk that healthcare workers will abuse drugs as a coping mechanism.

COVID-19 has also significantly disrupted drug treatment programs and facilities. These rely on one-on-one counseling and group therapy. Addiction is a disease of isolation. Both in-patient and out-patient drug treatment programs include soothing human contact such as handshakes, hugs and other social rituals to build bonds of support.

As a result of shelter-in-place and social distancing orders, treatment programs were forced to transition to Web-based remote counseling efforts. These are not ideal for drug treatment.

A preliminary analysis by the White House Office of National Drug Control Policy showed an 11.4 percent increase year over year in opioid overdose fatalities for the first four months of 2020. The analysis attributed the increase to the impacts of quarantines, lockdowns, and economic uncertainty impacting the addiction crisis.

Methadone clinics—which dispensed daily doses of medicine to opioid-dependent people in treatment—faced difficulties with social distancing as well. Clinics were authorized to switch to dispensing up to 25-day dosage units at a time for self-administration by patients. In addition, people struggling with drug dependency faced layoffs, unemployment, eviction, social isolation and other stressors that increase feelings of desperation. These factors have dramatically increased risk of relapse for those suffering from the disease of addiction.

Additionally, as a result of COVID-19 there is increased pressure on diversion control programs. In April 2020, the DEA increased quotas by 15 percent for manufacturing and importation of controlled substances to prepare for an increased demand from patients on ventilators requiring fentanyl, morphine and codeine. Simultaneously, the ease of access to controlled substances for healthcare professionals was increased. Telemedicine regulations were also eased to make it easier for physicians to prescribe medication to patients without an in-person examination.

These three actions, while potentially beneficial during the pandemic, also increased the risk of diversion of pharmaceuticals for illicit use. Earlier this year, the National Safety Council (NSC) released recommendations and guidance around COVID-19 associated opioid risk in the workplace. According to the American Medical Association (AMA) in June, more than 30 U.S. states reported increases in overdose deaths. Kentucky estimated a 25 percent increase in overdose deaths as well as a rise in emergency medical calls and emergency room visits related to overdoses. In Cook County, Illinois, suspected or confirmed overdose deaths doubled in the first five months of 2020.

Increased overdose deaths are an indicator of increased drug abuse and demand. These will place further pressures and increased challenges to drug diversion loss prevention programs.

High-Risk Areas

Best practices and risk profiles for drug diversion vary depending on whether the program is for a retail pharmacy, hospital pharmacy, medical clinic, doctor's office, pharmaceutical company or other entity. Three venues, however, are the more common, reoccurring high-risk areas for drug loss.

Brick-and-mortar pharmacies. We all know the old phrase in murder mysteries: "The butler did it." In any retail pharmacy practice, the same association holds true for loss of controlled substances and pharmacy technicians. In many instances, when there is a loss of drugs in a pharmacy, a pharmacy tech is responsible.

Another high-risk area for diversion in any pharmacy is "returns," a term for drugs that are expired or have been recalled and are stored pending return or transfer to a distributor for destruction. When proper controls are not in place, returned controlled substances are at high risk of theft. These drugs should be inventoried and kept secure in a locker or safe until their transfer.

A third major risk—secure record keeping systems and cybersecurity—was identified during the mass protests in the United States throughout May and June 2020, when brick-and-mortar pharmacies nationwide became targets for looters who carried out large quantities of prescription drugs. Drugs used to manage abuse, which can also be abused, were popular targets, as were stimulants such as Adderall.

In Philadelphia, 180 of the city's 476 retail pharmacies were broken into and looted; Philadelphia Police Department investigators believe the pharmacy attacks there were strategically planned.

At some locations, in addition to stealing the narcotics, looters hauled away the computer systems the pharmacists used to maintain the inventory audits, making it difficult to ascertain what medications were stolen, and complicating pharmacies' regulatory compliance reporting of drug theft.

Hospital pharmacies. Hospital pharmacy practices carry many of the same risks of a retail brick-and-mortar pharmacy, with two additional significant risk areas. One is Automatic Dispensing Machines (ADMs). The second is the liquid drugs and syringes used daily throughout the hospital. Both are the most common areas in a hospital where drug diversion occurs.

ADMs are the medical equivalent of ATMs and should be treated as such. Access and policies should be up to date, and usages should be reviewed at least weekly by supervisory personnel.

Syringes containing powerful opioids are an important and daily tool in a hospital, but they need to be kept secure before and after their use through policies that limit access before use and "rule of two" wasting at their completion. The rule of two mandates that at least two people be physically present to conduct, witness and certify the activity. Having a second person present is intended to decrease opportunities for theft.

Medical personnel across the country continue to divert syringes containing opioids for their own illicit personal use, usually in the minutes before and after their legitimate use.

In December 2019, a nurse at the University of Colorado Hospital was sentenced to U.S. federal prison for stealing opioids by deceit and tampering with a consumer product. She used her access to ADMs to steal opioids intended to treat patients. She used a syringe to self-inject the fentanyl and hydromorphone in a hospital bathroom, refilled the medicine vials with saline solution, and placed them back into the ADM.

Medical clinics. Medical clinics that do not store drugs generally carry low risk except in one area: access to the medical provider's paper or electronic prescription pad.

Oftentimes, an employee of the office will either fraudulently prepare a paper prescription, telephone in a fraudulent prescription, or—if he or she has access—submit a fraudulent prescription electronically.

For example, in May 2020, a medical office manager in Buffalo pled guilty in U.S. federal court to issuing or causing 116 fraudulent hydrocodone and oxycodone prescriptions over a three-year period without a physician's authorization.

The manager accessed the physician's prescription pad and a New York State-issued controlled substance electronic prescribing hard token and passwords. He then filled the prescriptions, issued in the names of associates and fictitious individuals, from various pharmacies in the region. The scheme was discovered when a suspicious pharmacist, who questioned the legitimacy of a prescription, contacted the physician.

It is extremely important that providers recognize these possibilities and always secure their paper prescription pads, never share their electronic passwords and routinely review their prescribing history at least quarterly for any abnormalities.

Management and Culture

The best drug diversion loss prevention efforts today are comprehensive programs with separate, yet equally important, components synched into an enterprise-wide undertaking. These vary by the type of entity being safeguarded. For example, most hospital in-patient pharmacy programs will include a focus on drug procurement, storage, dispensing, return and disposal; physical security; surgical areas; physician prescribing; and nursing care usage.

The programs also feature multidisciplinary resources to tackle the mission. A diversion program manager now routinely works in concert with a security manager, legal, management, HR, IT, a pharmaceutical specialist or team member, and a head nurse. This approach is critical to synthesize unique technical knowledge, expertise and perspectives to quickly eliminate anomalies that have legitimate explanations, and then immediately focus program resources on red flags that require quick mitigation actions.

An organization's drug diversion culture is key to its success. Studies from various sources, including The American Journal on Addictions, show that 10 to 15 percent of healthcare workers are at risk of substance abuse. These are the personnel who pose great risk to the illicit diversion of pharmaceutical drugs.

That means that the overwhelming majority of workers—the remaining 85 to 90 percent of employees—can be recruited to serve as the first line of defense to protect the organization and its patients from risks of drug diversion. These professionals can be educated on what kinds of coworker behavior may be indicative of drug dependency. In a 2020 Porter Research survey of healthcare executives, 75 percent reported that their organization used diversion awareness programs, and of those, 85 percent reported that their program includes employee tips on suspicious activities.

There are many indicators of opioid pain medication abuse, and their value increases with the presence of each additional indicator. Examples include repeated failure to fulfill work and educational obligations; falling asleep in vehicles, at workstations or in restrooms during breaks; and withdrawal from social, recreational or professional activities. Physically, pinpoint pupils are indicators of opioid intoxication and overdose; dilated pupils are indicators of opioid withdrawal. Other indicators of withdrawal include nausea, restlessness, cramps, sweating, runny nose, watery eyes and mood swings.

"If you see something, say something" is as important to any drug diversion program as it is to antiterrorism initiatives.

Monitoring and Surveillance

Over and over again, failures in monitoring and surveillance regimens have surfaced as weaknesses in drug diversion programs. The strength of these systems will determine how well irregularities are ferreted out and flagged for appropriate action. Monitoring and surveillance is the primary role of diversion program managers.

One recent DEA investigation in Cook County, Illinois, highlights this problem. Criminal investigators were contacted by relatives of several elderly patients who had been receiving long-term care from a physician who specialized in caring for homebound seniors. Many of them had mobility issues, making trips to doctor's offices difficult.

The patients' relatives reported they became suspicious of the types and amounts of medications being prescribed for their loved ones. When investigators conducted interviews and examined records, their attention quickly focused on the physician—a reputable doctor who had been conducting in-home care for more than a decade.

With the consent of cooperating victims, investigators installed hidden cameras and microphones in their homes. Soon thereafter, while making rounds, the doctor was captured repeatedly on video stealing pills from patients' prescription bottles. Investigators established the physician was prescribing opioid pain medications to her senior patients that they did not need and could not afford. During her visits to their homes for examinations, the physician would distract the patient, often asking them to retrieve an item in another room, while she emptied pills into her pockets.

While this may sound like petty crime, the doctor had hundreds of patients, and the illicit street value of drugs being regularly stolen was significant. Had proper monitoring and surveillance systems been in place, the physician's irregularities would have been quickly identified and flagged by the medical provider, pharmacy and healthcare providers.

All U.S. states, except Missouri, now have statewide electronic databases that require medical providers to track prescriptions with the potential for abuse. These allow pharmacists and doctors to see a patient's prescription history so they can identify and flag for action an irregularity that may indicate a disease of addiction.

Partnering with Artificial Intelligence

Artificial intelligence (AI) is now a critical partner and best practice in drug diversion programs.

In all risk mitigation strategies, the steps are the same: identify, assess and mitigate. The strategy is a failure from the start when identification does not occur. A recurring issue in drug diversion programs is effectively using limited resources to ensure potential risks are initially identified. This is a function of monitoring and surveillance—AI blends the talents of IT, diversion program managers and healthcare experts.

AI uses algorithms to help identify higher-risk medications and higher-risk dispensing patterns among healthcare personnel. Some of these software programs use risk-scoring formulas that combine data from physically tracking drugs in the supply chain, patient medical records and behavioral analyses of healthcare staff. These programs also quickly spot outliers and alert security personnel. The program could help personnel catch whether a hospital pharmacist dispensed a drug when they were not working or if a nurse or technician signed out a drug at 9:00 a.m. but disposed of it at 2:00 p.m.

In June 2020, a registered nurse at a nursing and rehabilitation facility in Massachusetts pled guilty in U.S. federal court to diverting and diluting morphine sulfate from patients, including an 89-year-old hospice patient. The nurse extracted the medication from bottles and replaced it with other liquids. The hospice patient received diluted morphine and suffered unnecessary pain. The nurse had tested positive for the presence of opiates during a drug screening in 2017. This case is an example of how AI systems might have prevented drug diversion by identifying the nurse's history as higher risk and worth additional scrutiny before granting access to or administration over highly addictive substances.

While AI is a force multiplier and when used effectively can enhance a monitoring and surveillance system, an experienced response team is essential to analyze the data, look for gaps and conduct follow-up investigations where appropriate. AI must never be considered a replacement for monitoring and surveillance. AI-enabled software is only as good as the diversion program manager, security manager and personnel who make decisions based on the information provided. The best program will have no value if security staff are not acting on it.

Audit, Audit, Audit

Internal audits are the lifeblood of successful drug diversion programs. One of the most important functions of an audit is to independently evaluate how well diversion managers are monitoring and surveilling. They also provide reviews of compliance with federal and state regulations and internal policies and procedures. Importantly, audits will also assess the quality and completeness of the diversion investigations conducted.

The comprehensive audit function includes everything in the lifecycle of controlled substances, from the beginning step in procurement through disbursement or disposal. In procurement alone, there must be audits of the use of the Controlled Substance Ordering System (CSOS), separation of duties between those who order and receive the order, signatures of witnesses upon receipt of orders, verification of licensed registrants in the process, validation of the chain of custody procedures and documentation, quarterly review of purchases against inventory and examination of compliance with purchasing in unit dose packages. An audit system—done correctly—will highlight any instances of noncompliance and identify opportunities to improve systems and procedures to the attention of managers.

Independent, third-party audits of diversion programs are highly recommended because they provide assurance and recommendations by an objective, external set of eyes that evaluate the organization's diversion program. These should include a review and assessment of policies and procedures, controls, monitoring, enforcement and internal improvement processes. Audits should also include evaluation of HR practices, substance abuse policies, employee drug abuse awareness programs, supervisor training, drug diversion program employee training and employee discipline for diversion violations.

Trusted Partners

While an outside perspective of drug diversion and loss prevention plans is helpful, organizations sometimes engage physical security consultants who fail to include regulations—such as Title 21, Code of Federal Regulations (CFR) requirements in the United States—in their final assessment and recommendations. It's one thing for security experts to provide physical security expertise, but with facilities handling controlled substances, employed experts should be versed in the federal regulatory requirements (CFR 1301.72) for pharmacies, narcotic treatment programs, drug storage areas in clinics, doctors' offices, medical facilities and manufacturers. This industry-specific knowledge and experience can produce significantly different guidance from general security practices.

For example, minimum security baselines for a U.S. pharmacy handling schedule I and II controlled substances will differ greatly in cost and sophistication depending on whether it was constructed before or after September 1971. There are many family-owned independent pharmacies scattered across the United States that have been in business for decades—housed in older buildings with simple steel door vaults, a combination or key lock and an alarm system—that fully comply with the CFR.

For any vault facilities constructed after September 1971, however, there are rigorous specifications that must be met to be compliant with the CFR. For example, the walls, floors and ceilings of the vault must be constructed of at least eight inches of reinforced concrete or other substantial masonry, reinforced vertically and horizontally with half-inch steel rods tied six inches on center, or the structural equivalent to such reinforced walls, floors and ceilings. Similar specific requirements relate to the door and frame, day gate and alarms.

Paying for drug diversion loss prevention consulting services needs to be about the right kind of experience and knowledge. Without the necessary background information and experience, a consultant might recommend investing in expensive security measures for compliance issues that do not apply to the organization.

The effects of COVID-19 help to illustrate how one event can have enormous impact on organizations and programs. The pandemic also underscores the importance of adjusting and reacting to ever-changing and complex threats.

Continual security and threat reviews, coupled with strong flexible policies, regularly occurring training and audit programs, and an organizational culture that requires its professionals to embrace knowledge and change will put drug diversion loss prevention leaders in position to fight this crime. 

Mark Giuffre, CPP, CFE (Certified Fraud Examiner), CAMS (Certified Anti-Money Laundering Specialist), is a director at security risk management firm Hillard Heintze, a Jenson Hughes company, where he supports clients in investigations, security and law enforcement consulting.

This article is reprinted from Security Management Magazine with permission from ASIS © 2020. All rights reserved.