Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

Stealing Wellness​

Detecting drug diversion fraud within hospitals is a collaborative process. 

Comments Views

​While attending a conference, Angus Munro, the CEO of a large academic medical center, heard from colleagues about their experiences with drug diversion, something he was increasingly concerned about within his hospital. Drugs represented almost 20 percent of his costs and were increasing annually. Conversations with his director of pharmacy left him unsatisfied with the rigor of controls in place for these multimillion-dollar inventory stores. While his primary concern was centered on the e​xceptionally expensive noncontrolled drugs, he also was aware of the growing opioid abuse problem in the community. If a newspaper story implicated the hospital in contributing to the crisis through poor internal controls, it would be devastating. He immediately contacted Mary Nicholls, the chief audit executive (CAE), to test internal controls. 

After some research, Nicholls learned that pharmaceutical diversion was on the rise nationally, and the methods had become more sophisticated. Recent diversion rings involved multiple hospitals and several actors actively collaborating at numerous levels of the organization. Historically, prescription drug diversion from pharmacies almost exclusively involved controlled substances (narcotics and other commonly abused drugs), primarily schedule II narcotics and other opioids that have a high potential for abuse and dependence. These medications were sold on the street directly to addicted individuals. 

Also contributing to diversion was the emergence of "pill parties" and "rave parties." These were common among middle and high school students who raided their parents' medicine cabinets or worked in areas to obtain access to random medications for party guests. 

Even more troubling to Nicholls were reports of amateur chemists making illegal drugs using noncontrolled prescription drugs and over-the-counter (OTC) drugs. For example, the commonly used OTC cold medication pseudoephedrine can be used to make methamphetamine or crystal meth. Because of this, some OTC medications became available only via prescription, and some prescription drugs were made controlled. Nicholls concluded that there was sufficient risk to perform a rigorous audit of controls around medication use. 

While Nicholls knew she may not detect any active diversion, she also knew that people often compromise their ethics out of necessity during times of distress, uncertainty, and economic hardship. Many healthcare insurance plans do not cover new, high-cost biologic, HIV, and chemotherapy medications. This, combined with loss of employment, has resulted in the emergence of a black market for high-cost, noncontrolled pharmaceuticals. In these cases, the patrons are not addicted individuals, but rather sick patients or family members who are unable to afford their medications. 

The largest diversion ring discovered in the U.S. began with a pharmacy inventory employee stealing a noncontrolled bone marrow drug for a relative with cancer who was unable to pay for it. The employee soon discovered a black market for patients in need and recruited other employees within his hospital and surrounding hospitals. 

Ironically, the discovery was made when the truck carrying the diverted drugs was hijacked by thieves expecting to steal pharmaceutical-grade narcotics. The hijackers deserted the truck when they discovered it was filled with HIV, cancer, and biologic medications. The hijackers were caught, which led police to the diversion ring. Eventually, it was discovered that some of the stolen medications were being sold back to the wholesalers for redistribution to the same hospitals. 

Within her hospital, Nicholls found that controlled substances had stronger controls (automation, double counts and checks, and segregations of duties) than noncontrolled substances, which can cost tens of thousands of dollars per dose. In the pharmacy, she found that there was one person assigned to create purchase orders (POs), place orders, receive medications, and reconcile orders to POs. The lack of segregation of duties demonstrated a significant opportunity for diversion. Nicholls also learned that due to the unique nature of medication-use oversight, the pharmacy was exempt from the safeguards that were in place within the materials management department and other areas of supply chain oversight. 

An audit of the purchasing records found high-cost chemotherapy medications and other drugs that were no longer in inventory and for which dispensing records did not support their use in patient care. A select audit of the two highest-cost drugs against their recorded use showed significant discrepancies, suggesting a material and pervasive problem that approximated 20 percent of purchases. 

Within the pharmacy, noncontrolled medications are generally stored on open shelves and in unlocked refrigerators because of the mindset that only drugs of abuse would be targeted for theft. Inventories were only taken annually, but not reconciled against purchases, usage, or waste. As a result, it was not possible to determine shrinkage by theft or other causes. In addition, hospital computer systems are not designed to reconcile medications administered with hospital purchases, as one might reconcile sales to purchases in a retail operation. 

Nicholls quickly concluded that insufficient levels of controls for pharmacy and medication-use systems, combined with the high street value of these medications, provided a significant opportunity for a diversion ring within the hospital. She recommended a comprehensive audit to scope the material impact on the hospital's financial statements. 

Furthermore, any diverted medications could create a potential source of litigation for the hospital. Background research revealed several high-profile medication diversion rings around the country at medical institutions such as the University of Colorado, the University of Maryland, and Georgetown University, which resulted in fines, jail time, and public embarrassment. The settlement in the case at Georgetown University Hospital resulted in the sale of the hospital by the university to settle the claims. Here, the diverters replaced unused medications with used vials, exposing patients to infectious diseases. The judgment in the class-action lawsuit exceeded the ability of the hospital to pay the claim.

Lessons Learned

  • While professional practices in health care may not traditionally control medications that have low abuse potential, the risk and inventory controls still need to be placed on high-cost items.
  • CAEs and risk managers play a key role in assuring that hospitals and health systems comply with audit and control standards, regardless of traditional professional practices.
  • Health-care professional practices need to be rigorously tested against audit and compliance standards to evaluate risk and vulnerabilities.
  • Health-care professionals rarely review operational practices through an audit, compliance, and accounting lens, and benefit greatly from the expertise of a CAE.   
  • Pharmaceutical drugs represent an average of 20 percent of hospital costs, and failure to control their diversion can have a material impact on financial statements.
  • Poor medication control can lead to medication diversion and represents a significant risk to hospital reputations when reported in the media. ​

Scott Mark
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Scott MarkScott Mark<p>​Scott Mark, PharmD, is vice president at Craneware Healthcare Intelligence in Pittsburgh.​</p>


Comment on this article

comments powered by Disqus
  • AuditBoard-May-2021-Premium-1
  • Awareness-Month-May-2021-Premium-2
  • Virtual-IC-May-2021-Premium-3



Thanks, We Already Know That, We Already Know That
U.S. SEC: Environmental, Social, and Governance Risks Better Be on Your Radar SEC: Environmental, Social, and Governance Risks Better Be on Your Radar
Six Data Privacy Predictions for 2020 Data Privacy Predictions for 2020
Public Servants Are Vital to Defeating COVID-19 Servants Are Vital to Defeating COVID-19