Ask people who run diversion programs how their cases actually started and the answers cluster into three channels: somebody said something, a count or a record did not reconcile, or a report of cabinet transactions showed one person doing something differently from everyone else. Very few start with a single unmistakable event. Most start with a signal that could have been nothing, followed by someone deciding to look. This guide describes each channel, what it catches and misses, and the sequence that turns a signal into a finding.

Channel one: people

Coworkers notice first. They notice a colleague who volunteers to give every opioid dose, who always wastes with the same partner, who disappears after pulling a syringe, whose patients report more pain than their charts suggest. They also notice the ordinary things: mood changes, long bathroom breaks, arriving early and leaving late. None of it is proof and most of the people who notice say nothing, because they are not sure, because they like the person, or because they do not know who to tell.

DEA's own regulations take a clear position on this for non-practitioner registrants: an employee who has knowledge of diversion by a fellow employee has an obligation to report it to a responsible security official, the employer must keep the report and the reporter's identity confidential, and the employer must tell all employees that this is the policy (21 CFR 1301.91). The rule is written for distributors and manufacturers, but the three elements in it, a duty to report, a named person to report to and a confidentiality promise, are exactly what makes the people channel work in a hospital or pharmacy too.

Patients and families are the second source in this channel. A complaint that pain relief did not arrive, that an injection “did nothing”, or that a home supply ran short after a visit from a particular caregiver is a diversion signal when it clusters around one person. The patient complaint guide covers how to route these.

What it catches: behavior that never touches a record, and tampering, which leaves no transaction trace at all. What it misses: careful people, and anything in a setting where one person works alone.

Channel two: reconciliation

The second channel is the oldest: counting things and comparing the count with the record. Every registrant must keep complete and accurate records of each controlled substance received, dispensed or otherwise disposed of (21 CFR 1304.21(a)) and must take a full inventory at least every two years (21 CFR 1304.11(c)). Hospitals must keep current and accurate records of the receipt and disposition of all scheduled drugs (42 CFR 482.25(a)(3)). A diversion program turns those requirements into a detection system by adding frequency and independence: shift counts, blind counts, periodic reconstructions of one drug's movement from receipt to disposition, and someone other than the people who handle the drug doing the comparison.

Reconciliation catches diversion in three recognizable shapes:

  • The unexplained shortage. The count is short and no transaction explains it. Investigated properly, the question becomes who had access between the last good count and this one.
  • The record that does not match its neighbor. A cabinet removal with no administration charted. A waste record with no removal behind it. A Form 41 destruction entry larger than what the reverse distributor received. A purchase total that outruns the dispensing total for the same product. Each is two records that should agree and do not.
  • The pattern of small losses. No single discrepancy is large, but they recur on the same drug, the same shift or the same name. The DEA rule on reportable losses lists “a pattern of losses over a specific time period” as one of the factors a registrant must weigh (21 CFR 1301.76(b)), which only works if discrepancies are kept in a form that can be sorted.

What it catches: theft from stock, order and receiving fraud, falsified destruction. What it misses: diversion at the point of administration, where the record balances because the drug was removed for a real patient and simply never reached them.

Channel three: transaction data

Automated dispensing cabinets, pharmacy systems and electronic health records produce a time-stamped trail: who removed what, for which patient, when it was charted as given, when and with whom it was wasted, which removals were overrides and which were cancelled. The third channel compares that trail across people doing the same job in the same place. The point-of-administration diversion that reconciliation misses is often visible here, because the diverter has to generate transactions to get the drug, and those transactions look different from a peer's.

The patterns that most often prompt a look:

  • More removals of a drug per shift, or per patient, than peers on the same unit.
  • Removals for patients assigned to someone else, or just before a shift ends.
  • Removals with no matching administration record, or administration charted long after removal.
  • Waste that is large, frequent, always for the same drug, always witnessed by the same person, or documented suspiciously quickly after removal.
  • A high share of overrides and cancelled transactions.
  • Patients whose documented pain scores do not change after documented doses, concentrated under one caregiver.

None of these proves anything. A nurse in a bay with the sickest patients will remove more opioids. A float nurse's transactions will look odd on every unit. The value of the channel is that it tells you where to apply the other two. The manual versus automated detection comparison looks at what tooling adds and what it does not.

What it catches: point-of-administration diversion, waste fraud, and slow patterns that no single reviewer would notice. What it misses: anything that happens before a transaction is generated, such as theft from a delivery tote, and anything the model is not looking for.

The channels that find it by accident

A fourth set of discoveries is not a channel so much as a reminder of the cost of the others failing. Tampering gets found when several patients on one unit develop an unexplained infection and the investigation works backward to a shared caregiver. Vial substitution gets found when a syringe of what should be an opioid produces no effect, or when a pharmacist notices a cap that does not sit right. Order fraud gets found when a wholesaler's suspicious order system flags a pharmacy and the pharmacy owner learns about purchases nobody remembers placing. Each of these had earlier, quieter signals in one of the three channels above.

From signal to finding: the confirmation sequence

Whichever channel produces the signal, the work of confirming it is the same, and the order matters.

  1. Secure the stock and preserve the records. Change what can be changed quietly: lock down the drug, pull and seal suspect vials, save camera footage before it rolls over, export the transaction data for the period. Do nothing yet that alerts the person.
  2. Triangulate. For each suspect transaction, line up the order, the removal, the administration record, the waste record, the witness and the patient's documented response. A real dose produces a consistent chain. A diverted one breaks somewhere.
  3. Compare against peers and against the person's own history. A change in someone's pattern over time is often more telling than a comparison with others.
  4. Check the other channels. A data signal is stronger with a coworker's observation behind it; a tip is stronger with a reconciliation discrepancy in the same window.
  5. Apply the reporting rules on discovery, not on certainty. If what you have is a theft or a significant loss under the factors in 21 CFR 1301.76(b), the written notice to DEA is due within one business day and Form 106 within 45 days, whether or not the person has been identified. Hospitals also report internally under 42 CFR 482.25(b)(7). State and licensing board duties may run in parallel.
  6. Interview last. The interview is where the facts are put to the person, not where they are gathered. The interview guide and investigation playbook cover the mechanics, including how to treat someone fairly when the pattern turns out to have an innocent explanation.

What this means for program design

A program built on one channel has that channel's blind spot. Reconciliation alone misses administration-point diversion. Data alone misses tampering and theft from receiving. People alone misses the careful diverter and the solo shift. The programs that catch diversion early run all three on a schedule, send every signal to the same intake, and have one person who sees the whole picture. The program guide lays out what that looks like, and the free assessment scores how much of it you already have.

Frequently asked questions

Which channel finds diversion fastest?
People, when they speak up, because the observation is immediate. Data is fastest when nobody speaks up, provided someone reviews the reports on a short cycle. Reconciliation is the slowest but the hardest to evade. Speed depends far more on how often a human looks than on which channel the signal came from.

Do we have to report a suspicion?
The federal theft and loss rule turns on whether there has been a theft or significant loss of a controlled substance, judged by the factors in 21 CFR 1301.76(b), not on whether you suspect a person. A suspicion with no loss behind it is an investigation, not a report. A loss you cannot explain may be reportable whether or not you suspect anyone. Licensing board duties about impaired or diverting professionals are a separate question that varies by state and profession.

What if the signal was wrong?
It will be, often. A review that clears someone should be documented as carefully as one that does not, and the person should be treated throughout as someone whose pattern had an explanation. A program that handles false signals badly stops receiving true ones.

Sources