In August 2026, STAT reported a case that should be required reading for every hospital buying AI-based diversion surveillance: at Adventist Health Bakersfield, managers ignored alerts from a machine-learning system that tracks when staff might be stealing drugs — and auditors later confirmed the flags had been ignored before a travel nurse diverted patient pain medication for weeks. The technology flagged it. The humans didn't act.

The Tools Are Getting Better — and That's Not Enough

Machine-learning surveillance is a genuine advance. Published research on a model trained on 27.9 million medication-movement transactions by roughly 19,000 nursing, pharmacy, and anesthesia clinicians showed the model could flag high-risk transactions and, in blinded testing against 22 known diversion cases, would have detected cases earlier than existing methods in some instances.

But a detection tool is only as good as the response workflow behind it. The Adventist case is the cautionary tale: the software produced alerts, managers did not act on them, and the diversion continued. Auditors don't just ask whether you have surveillance — they ask what you did with what it found.

The Alert-to-Action Workflow

  • Name an alert owner. Every alert needs a defined owner — typically the diversion program manager, pharmacy leadership, or a designated committee member. "The software watches the data" is not an owner.
  • Set a triage SLA. Define how quickly alerts get reviewed: initial triage within one business day, full investigation of substantiated flags within a set window, and escalation for high-risk patterns (controlled-substance discrepancies, documented waste anomalies, overnight access patterns).
  • Build an escalation path. When an alert implicates a specific individual, define who is told, when, and how — security, nursing leadership, HR, and the compliance committee each have a role, and the workflow should name them.
  • Document every disposition. For each alert, record the review, the decision (substantiated / not substantiated / monitor), and the action. This documentation is what you show an auditor, a surveyor, or the board when they ask whether the program works.
  • Fight alert fatigue deliberately. If your team is drowning in alerts, tune thresholds and review the alert logic — but never let fatigue become the reason a flag goes unanswered. An unactioned alert is worse than no alert: it creates documented knowledge of a risk that wasn't addressed.

What the Human Side Catches That Software Can't

In the Adventist case, STAT reported that patients noticed the nurse acting strangely before the system's value — or failure — became clear. Behavioral observations, patient complaints, and staff concerns remain the layer no algorithm fully replaces. Patients who say their pain medication "isn't working" or that pills look different are a documented diversion signal. Staff who notice a colleague volunteering for overtime, disappearing from the unit, or insisting on handling controlled substances alone are describing classic red flags.

A complete program pairs machine surveillance with:

  • A documented behavioral-observation and anonymous-reporting channel.
  • Patient complaint routing into the diversion review process.
  • Regular human audits of waste documentation, counts, and overrides.
  • Leadership that treats "we had an alert and didn't act" as a process failure, not a technology failure.

How to Prove Your Program Works

  • Track metrics. Alerts received, reviewed on time, substantiated, escalated — a simple dashboard shows the program is alive.
  • Run the audit test yourself. Before an external auditor does, pull a sample of alerts from the last quarter and check that each has a documented disposition.
  • Drill with your committee. Walk through one real alert end-to-end in front of the diversion committee so the workflow is a practiced muscle, not a policy on a shelf.

The Bottom Line

Buy the technology if it fits your program — but budget for the humans who triage, investigate, and act. An AI surveillance system without an alert-to-action workflow is a very expensive way to discover that you knew, and did nothing.

Related Reading