What Happened
An office manager for a physician's practice in Williamsville, New York used her workplace access to the physician's prescription pad and state-issued electronic prescribing credential to issue 166 fraudulent controlled-substance prescriptions over roughly three years.
Between 2015 and March 2018, the office manager issued prescriptions for hydrocodone and oxycodone — totaling approximately 11,885 dosage units — in her own name, the names of associates, and fictitious individuals, all without the physician's knowledge or authorization. She then filled the prescriptions at various local pharmacies and diverted the drugs for personal use. The scheme unraveled in March 2018 when a Rite Aid pharmacist questioned the legitimacy of one of her prescriptions and called the physician directly to confirm it, leading to her firing and the criminal investigation.
She was convicted of obtaining a controlled substance by fraud and sentenced on September 17, 2020, to two years of probation and $1,911.23 in restitution.
What Went Wrong
- A single employee held unsupervised access to prescribing credentials. The office manager had standalone access to both the physician's paper prescription pad and the state e-prescribing hard token, with no dual control over their use.
- 166 prescriptions went out over three years without the physician noticing. Nothing in the practice's workflow reconciled prescriptions issued under the physician's name and DEA registration against what the physician actually authorized.
- Detection depended entirely on an alert outside pharmacist. The practice's own controls never caught the fraud; a pharmacist's independent skepticism did.
How It Could Have Been Prevented
- Restrict access to prescription pads and e-prescribing credentials (including hard tokens and passwords) to licensed prescribers only, never delegated to office staff.
- Have physicians periodically reconcile prescriptions issued under their DEA registration against their own patient records and appointment logs.
- Require secure, individually-audited storage and issuance logs for physical prescription pads in small practices.
- Train community pharmacists to call the prescribing office directly whenever a prescription's context looks inconsistent with the named patient.
Related Guidance
- 15 Red Flags of Drug Diversion — Indicators including unauthorized prescribing credential use.
- Regulatory Guide — DEA registrant recordkeeping and prescription pad security obligations.
- Diversion Prevention Checklist — Controls applicable to small outpatient practices.
- Diversion Case Registry — Related non-clinical staff diversion cases.