What Happened
Massachusetts General Hospital agreed to pay the United States $2.3 million — at the time the largest settlement of its kind — to resolve allegations that lax controls allowed hospital employees to divert controlled substances.
DEA opened its investigation in 2013 after MGH disclosed that two of its nurses had stolen almost 16,000 pills, mostly oxycodone, from an automated dispensing machine used to store prescription medications. A subsequent DEA audit of the hospital's controlled-substance records found pill-count discrepancies totaling more than 20,000 missing or incomplete medication inventories, along with hundreds of missing drug records.
As part of the settlement, announced September 28, 2015, MGH agreed to a corrective action plan that included enhanced diversion monitoring by supervisors and management, annual external compliance audits, and increased physical controls over automated dispensing machines, including fingerprint-based access. Most of the plan's improvements were already implemented by the time of the announcement.
What Went Wrong
Two nurses were able to divert nearly 16,000 pills from an automated dispensing machine before the hospital caught on, and a follow-up DEA audit found the underlying recordkeeping gap was far larger than the disclosed incident. Key failures included:
- Automated dispensing machines lacked sufficiently granular access controls to isolate which individual removed which medication.
- Supervisory monitoring of dispensing activity was not routine enough to catch a sustained pattern of diversion by two employees.
- Recordkeeping gaps left more than 20,000 medication records missing or incomplete, far exceeding the scope of the disclosed theft.
- There was no independent, recurring external audit process to catch discrepancies before they reached this scale.
How It Could Have Been Prevented
- Require fingerprint or other biometric identification for every automated dispensing machine transaction, tied to individual accountability.
- Conduct scheduled, recurring external audits of controlled-substance recordkeeping rather than relying on self-disclosure to trigger review.
- Assign supervisors to actively monitor dispensing reports for unusual withdrawal patterns, not just respond after a threshold is crossed.
- Reconcile automated dispensing machine records against administration and waste documentation on an ongoing basis to catch gaps in near-real time.
- Treat a disclosed incident as a signal to audit the full facility's controlled-substance recordkeeping, not just the specific employees involved.
Related Guidance
- Hospital Diversion Prevention Checklist — Hospital self-assessment, 8 sections 63 items, including inventory, recordkeeping, and DEA reporting controls.
- Controlled Substance Inventory Requirements — Biennial inventory requirements and recordkeeping practices that surface losses.
- Analytics Dashboard Guide — Analytics KPIs and benchmarks for surfacing dispensing and inventory discrepancies early.
- 15 Red Flags of Drug Diversion — Behavioral and transactional indicators, including unexplained inventory shortfalls.