Can I report suspected drug diversion anonymously?

Yes, in most healthcare organizations you can report suspected diversion anonymously through a compliance hotline, anonymous tip line, or similar reporting mechanism. The DEA also accepts anonymous tips through its Diversion Control Division. However, anonymous reports may be harder for investigators to follow up on if they need clarifying information. If you are concerned about retaliation, federal and state laws provide meaningful protections for good-faith reporters, and most healthcare organizations have explicit non-retaliation policies for compliance reports. Speaking with your compliance officer about those protections before deciding whether to report with or without your name is a reasonable step.

Do I report to my supervisor or to the DEA first?

For most internal observations of suspected diversion, report to your immediate supervisor or directly to the pharmacy diversion program or compliance department first — not to the DEA. The DEA is notified by the facility when the situation meets the threshold for a reportable theft or significant loss under the DEA Form 106 requirements. The exception is if you believe that your supervisor is involved in the diversion or that reporting internally will result in suppression of the report — in that case, you should bypass the internal chain and contact your compliance officer, legal counsel, or directly contact the DEA or relevant state authority.

What if I report diversion and I turn out to be wrong?

A good-faith report of suspected diversion that does not result in confirmed findings is not a punishable mistake. Non-retaliation policies in healthcare organizations — and federal and state whistleblower protections — cover good-faith reports made without malicious intent. The key is that your report is based on what you actually observed, documented in objective terms, and not motivated by personal animus toward the individual you are reporting about. If your observation raises a genuine concern, report it: the investigation process exists to determine whether the concern is substantiated.

Am I protected from retaliation for reporting drug diversion?

Yes. Healthcare employees who make good-faith reports of suspected regulatory violations or patient safety concerns are protected from retaliation by a combination of federal law (including the False Claims Act whistleblower provisions where applicable, and Joint Commission standards), state whistleblower statutes, and most organizations' internal non-retaliation policies. If you experience adverse employment action after making a good-faith compliance report, consult with an employment attorney about your rights. Document the timeline of your report and any subsequent actions taken against you.

How to Report Drug Diversion: A Step-by-Step Guide…

Knowing what to do when you suspect a colleague is diverting medications is one of the most challenging moments in healthcare compliance. Most staff members who observe concerning behavior or documentation do not report it — not because they lack concern, but because they are uncertain who to tell, what to say, and whether reporting will put them at risk. This guide walks through the internal reporting chain, how to document your observation, when the DEA must be notified, and what protections exist for those who report in good faith.

Step 1: Document Your Observation First

Before you report anything to anyone, write down exactly what you observed — as soon as possible after observing it, while the details are fresh. Your documentation should capture:

What you saw, heard, or discovered — described in objective, factual terms. "I observed [name] remove a syringe from the medication dispense cabinet and place it in their pocket" is an observation. "I think [name] is stealing drugs" is a conclusion. Report observations; let investigators draw conclusions.
The date, time, and location of what you observed
Who else was present — anyone who may also have witnessed the same event
Any physical evidence that was present at the time — for example, a medication package that appeared to have been opened and resealed, a count discrepancy you discovered, or a waste record that did not match what you observed being wasted

Do not speculate in your documentation about why the person did what you observed, what their intentions were, or what their personal circumstances might be. Stick to what you directly perceived. Speculation can undermine the credibility of your factual observations in a subsequent investigation.

Step 2: Report to Your Immediate Supervisor or Pharmacy Compliance

In most circumstances, the appropriate first contact for a diversion concern is your immediate supervisor — typically the charge nurse, pharmacy supervisor, or department manager — or the pharmacy compliance or diversion prevention team if your organization has one. If the concern involves your immediate supervisor, go to your supervisor's supervisor or directly to the pharmacy compliance team.

When you report, share your written documentation, not just a verbal account. Having the observation in writing creates a contemporaneous record that the report was made and when, which protects you and ensures the information is accurately conveyed to those who will investigate.

A well-designed internal reporting system will acknowledge receipt of your report and tell you what happens next. You may be asked to provide a formal written statement. You are not the investigator — once you have made your report, the diversion prevention team or compliance department takes over. Do not conduct your own investigation or take action against the individual you reported about.

Step 3: The Internal Investigation Chain

Once a diversion concern is reported internally, the typical investigation chain proceeds as follows:

Pharmacy diversion prevention team or compliance department receives the report and assigns an investigator (typically a pharmacist or compliance officer with diversion investigation training)
Preliminary inquiry — reviewing the available records (transaction data, waste logs, inventory counts) to determine whether the concern is corroborated by documentation
Human resources and legal counsel are typically notified at an early stage so that employment and legal considerations can be managed in parallel
Security may be involved if the situation involves a risk of ongoing harm or asset protection
Interview of the subject — conducted by HR, compliance, or both, after the preliminary records review has provided enough information to frame the inquiry appropriately

Most organizations require that the identity of the initial reporter be kept confidential to the extent possible — your report should not be disclosed to the subject of the investigation. However, in cases where your report is the primary evidence (e.g., a direct observation with no other corroborating records), maintaining complete confidentiality throughout the process may not be possible.

When a DEA Form 106 Is Required: The One-Business-Day Preliminary Notification Rule

Not every internal diversion concern rises to the level of a required DEA notification. The obligation to notify the DEA arises when a theft or significant loss of controlled substances is confirmed (or reasonably believed to have occurred). The DEA reporting framework involves two steps:

Preliminary notification: Within one business day of discovery of a theft or significant loss, the registrant must notify the DEA Field Division Office for the area in which the registered location is located. This preliminary notification can be made by telephone and must include the DEA registration number, the registered name and address, the general description of the substances involved, and the approximate quantity lost. This one-business-day rule is a hard deadline — missing it is itself a regulatory violation. See our preliminary notification guide for a detailed walkthrough of this step.
DEA Form 106: Within 45 days of discovery, a completed DEA Form 106 must be filed with the DEA. Form 106 requires a full accounting of what was lost, when, under what circumstances, and what investigation was conducted. See the DEA Form 106 guide for the complete filing requirements.

Determining whether a situation constitutes a reportable "significant loss" versus an unexplained discrepancy that may not rise to that threshold is a judgment call that should involve your compliance counsel and pharmacy leadership. The DEA's guidance indicates that whether a loss is "significant" depends on the quantity, the pattern of losses, and the circumstances — not just a bright-line quantity threshold.

State Board of Pharmacy Obligations

In addition to the federal DEA reporting obligations, most state boards of pharmacy have their own reporting requirements when a licensed healthcare professional diverts controlled substances. State board reporting obligations vary by jurisdiction but typically include:

Notification to the state board when a licensed pharmacist, pharmacy technician, nurse, or other licensed provider is found to have diverted controlled substances from your facility
Specific timelines for notification — often within 30 days of confirmation, though some states require faster reporting
Submission of documentation supporting the finding

Failure to report to the state board when required is an independent regulatory violation, separate from the DEA reporting obligation. Review your state's pharmacy practice act and board regulations for the specific requirements applicable to your jurisdiction.

Protections for Reporters

Healthcare employees who report suspected diversion in good faith are protected by multiple overlapping frameworks:

Internal non-retaliation policies: Most healthcare organizations explicitly prohibit retaliation against employees who make good-faith compliance reports. These policies are typically enforced by HR and compliance departments.
State whistleblower statutes: Most states have laws protecting employees from retaliation for reporting regulatory violations or public safety concerns to government authorities. Protections vary significantly by state.
Federal law: Certain federal whistleblower provisions — including those in the False Claims Act and, in some contexts, the Controlled Substances Act's regulatory framework — provide additional protection depending on the specific circumstances of the report.

The protection of good-faith reporters is not merely an ethical commitment — it is an operational necessity for any diversion prevention program. A culture in which staff members fear reporting observed diversion is a culture in which diversion continues undetected and unaddressed. Building and communicating robust non-retaliation protections is as important to a diversion prevention program as building the surveillance analytics that detect patterns.

What to Do If the Internal Report Is Ignored or Suppressed

Occasionally, a good-faith internal diversion report is not acted upon — because of organizational politics, because a supervisor is personally involved, or because the compliance system is insufficiently independent. If you have made an internal report and have reason to believe it is being suppressed or ignored:

Contact your organization's compliance hotline, if one exists (many are operated by a third party to ensure independence)
Escalate to the Chief Compliance Officer or General Counsel
Contact the DEA Diversion Control Division directly — you can report suspected diversion by a registrant directly to the DEA regardless of what your employer does or does not do internally
Contact the applicable state board of pharmacy, particularly if a licensed professional is involved

Frequently Asked Questions

Can I report anonymously?

Yes — most organizations offer anonymous reporting through a compliance hotline, and the DEA also accepts anonymous tips. Anonymous reports may be harder to follow up on if investigators need clarifying details. Federal and state non-retaliation protections cover named good-faith reporters as well.

Do I report to my boss or the DEA first?

For most internal observations, report internally first — to your supervisor, pharmacy compliance, or the diversion prevention team. The DEA is notified by the facility when the situation meets the Form 106 reportable threshold. If you believe internal reporting will be suppressed or your supervisor is implicated, go directly to compliance leadership or the DEA.

What if I'm wrong?

A good-faith report based on what you actually observed is not punishable if the investigation does not find diversion. Document your observation objectively, report it, and let investigators determine what it means. Non-retaliation protections cover good-faith reporters even when the investigation does not confirm their concern.

Am I protected from retaliation?

Yes — federal and state whistleblower protections, and most organizations' internal non-retaliation policies, cover good-faith compliance reports. If you experience adverse employment action after reporting, consult with an employment attorney and document the timeline carefully.

How to Report Drug Diversion: A Step-by-Step Guide for Healthcare Staff