Drug Diversion KPIs, Detection Thresholds and Dashboards
What a diversion program measures, the thresholds that make a number worth a second look, how a signal climbs from a rule to a case, and the three dashboards that keep a pharmacy team working from the same facts.
In short. A diversion program measures three things: how unusual one person’s controlled-substance activity is against peers doing the same work (detection), how fast and how completely each signal is worked to a recorded outcome (response), and whether the controls that prevent diversion are actually being followed (compliance). Detection indicators are computed per person, unit and drug and compared with a local baseline; program KPIs are computed per period and reviewed by the team. Neither is proof of anything: every number below is a prompt to look, not a conclusion.
Jump to the detection-indicator table or the program-KPI table. For the qualitative warning signs (behavior, documentation, inventory), see the 15 red flags; this page is the measured companion to that list.
How diversion shows up in the data
Each scheme below leaves a pattern in cabinet, order, count or prescribing data. The pattern is what a rule can look for; the explanation is what a reviewer has to establish.
Excessive dispensing or withdrawal frequency
One clinician removes controlled substances far more often than peers assigned to similar patients. The pattern is a high removal count per shift worked, often concentrated in one drug, that is out of proportion to the unit’s acuity.
High override rate or waste not witnessed
Overrides skip pharmacist order verification, and unwitnessed waste skips the second set of eyes. A person who uses either far more than peers is working around the two controls designed to stop a solo diversion.
Reverse distribution and return-to-stock manipulation
Product is removed, then returned or sent back in a way that hides a shortage: a tampered or substituted item returned to stock, or returns that do not reconcile with what was removed. The signal is a high return rate for one user, or returns whose count or seal does not match.
Cancelled-then-reordered orders
An order is cancelled after a removal, or cancelled and re-entered so that a second removal can be made against it. The pattern is a high cancel rate tied to one user’s removals, or removals against orders that no longer exist.
Administration at shift edges or on days off
Removals cluster in the first and last minutes of a shift, when handoff blurs accountability, or occur when the person is not scheduled. The data shows removals timed against the schedule or time clock instead of the patient’s orders.
Disproportionate prescribing by provider
One prescriber’s controlled-substance prescribing sits far from peers in the same specialty after adjusting for volume. Diverted prescriptions, forged scripts and pill-mill patterns appear as outliers in a provider-level comparison.
Cabinet access outside assigned unit hours
A user pulls from a cabinet on a unit they are not assigned to that shift, or outside their scheduled hours, usually to reach stock with less scrutiny. The signal is access events with no matching assignment or patient.
Quantity discrepancies at cycle count
Counts do not match the perpetual inventory, repeatedly, on the same unit or drug. A single discrepancy is usually an error; a run of them that share a last user or a time window is a pattern.
Repeated “patient refused” with no witness
A dose is removed, documented as refused or not given, and returned or wasted without a witness. The pattern is a refusal rate well above peers, especially where the refusal never reaches the patient’s record the same way twice.
Diversion of waste (partial vials)
The unused portion of a vial or syringe is taken instead of discarded, or waste is documented in full while the witness signs without seeing it. Look for high wasted-dose rates, waste documented seconds after removal, or the same witness appearing repeatedly with one user.
Real cases that turned on these methods are in the diversion case library and the searchable case database; the registry totals are on the open data page.
Detection indicators and thresholds
The table gives twelve indicators: how each is computed, a starting threshold, what it usually means, and the ordinary reason it fires for someone who is doing nothing wrong. Most are expressed as a ratio to a peer baseline (the median for the same unit, role and shift type), because a raw count means little without knowing how much work the person did and where.
| Indicator | How it is computed | Starting threshold | What it usually means | Typical false positive |
|---|---|---|---|---|
| Dispense-frequency ratio vs peer baseline | Controlled-substance removals per shift worked by the user, divided by the median for peers on the same unit, role and shift type; rolling 30 days. | About 2x peer median, with a minimum volume (for example 10 removals) so small counts do not fire. | More removals than the work explains; the broadest and noisiest first screen for diversion. | Assigned to higher-acuity patients, float or resource staff, covering breaks, or new to the unit. |
| Override rate | Override removals divided by all removals, per user, per unit and per drug class; rolling 30 days. | User at 2x peer rate, or above 20% (the analytics dashboard guide uses 10% and 20% as monitor and investigate bands). | Routinely bypassing pharmacist verification and its audit trail. | ED, OR and anesthesia, where overrides are routine, and cabinet or interface downtime. |
| Wasted-dose rate | Waste events divided by removals (and wasted quantity divided by removed quantity), per user and drug. | 2x peer rate for the same drug and unit. | Taking the unused portion, or removing more than the order needs. | Fixed vial sizes larger than ordered doses, and procedural areas that waste by design. |
| Unwitnessed waste count | Waste records with no witness, or a witness who signed after the fact, per user per 30 days. | Any record outside a documented exception; three or more for one user in 30 days goes to review. | The second-person control is being skipped or rubber-stamped. | Documented system downtime, or a single-nurse unit that has a written exception path. |
| Reverse-distribution rate | Returns to pharmacy or to stock divided by removals, per user; plus the share of returns whose count or seal does not reconcile. | 2x peer rate, or any return that fails reconciliation. | Removing and returning to hide a shortage, or returning a substituted product. | Order changes after rounds, discharges and transfers. |
| Discrepancy rate per 1,000 doses | Count discrepancies divided by doses dispensed, times 1,000, per unit and drug, with the last user of each. | Unit at about 2x its own trailing 90-day median, or one user as last user in a disproportionate share. | A process failure or a pattern tied to a person or time window. | A new cabinet, a changed counting rule, or a drug stocked in awkward packaging. |
| Shift-edge administration rate | Share of a user’s removals within a set window (for example 30 minutes) of shift start or end, or while not scheduled. | 2x the peer share; any removal while off the schedule goes to review. | Activity timed to handoff, or on days off, when oversight is thinnest. | Scheduled doses that fall at 0900 or 2100 near change of shift, and overtime missing from the schedule. |
| Provider prescribing z-score | (Provider’s controlled-substance prescriptions per 100 visits minus the peer mean) divided by the peer standard deviation, within specialty. | z of 3 or more for review; 2 to 3 for watch. | A prescriber far from specialty peers, which can reflect diversion, forgery or a clinical-practice problem. | Pain, palliative or addiction medicine, an unusual panel mix, or very small panels. |
| ADC access outside assigned area | Cabinet access events on units the user was not assigned to that shift, divided by all of the user’s access events. | Any event with no assignment, patient or code response behind it; repeated events for one user go to review. | Reaching stock with less scrutiny. | Float staff, anesthesia techs, code response, and stale assignment data. |
| Cancelled-order rate | Orders cancelled or discontinued after a removal, divided by orders, per user; plus cancel-and-reorder pairs. | 2x peer rate, or repeated cancel-and-reorder pairs for one user. | Orders used to justify a removal that is then unsupported. | Orders rewritten after rounds, and order-set changes. |
| Refused-without-witness rate | Doses documented as refused or not given and then returned or wasted without a witness, divided by removals, per user. | 2x peer rate; any refusal with a waste but no witness. | A removal with no dose reaching the patient. | Patients who really do refuse often, such as on palliative or psychiatric units. |
| Time from event to detection | Median hours or days from the first suspicious transaction to the alert reaching a reviewer (and, in a confirmed case, to the first ever signal). | Rules run daily; alert in the queue within 24 hours of the event. | How long a problem can run unseen. A process measure, not a person-level alert. | Inflated by weekly batch data loads, and by cases found by tips where the first event is unclear. |
Two cautions on using the table. First, combine indicators: one person flagged on frequency, override rate and shift-edge timing together is a far stronger hypothesis than any one of them alone. Second, compare like with like. A ratio against hospital-wide averages mostly measures which unit someone works on. The manual vs. automated detection comparison covers where peer scoring is blind and where counts and reconciliations still do the work.
How signals bubble up
A rule firing is the start of the process, not the end. The ladder below keeps volume manageable and makes sure every alert ends with a recorded outcome.
- An automated rule fires. A scheduled query or the monitoring tool evaluates an indicator and produces an alert for a person, drug and date range.
- It is queued with context. The alert arrives with the peer comparison (the user’s value against the unit median), the number of patients involved, the shift and unit, and any other indicator already flagged for the same person. An alert with no context cannot be triaged quickly.
- A clinical or pharmacy reviewer triages it within a stated window. As an illustrative starting point, one business day for a standard alert and the same shift where patients may be at risk. The reviewer checks assignment, acuity and downtime and either closes it with a reason or escalates.
- An investigation is opened with an evidence package. The package holds the transaction detail, the peer comparison, chart review against orders, administration and pain scores, and the timeline. From here the investigation playbook applies.
- The outcome is recorded and reported. Substantiated, unsubstantiated or process failure, with the action taken, and any required regulatory or licensing report filed on time (see the DEA 106 filing guide). The outcome feeds the scorecard.
What makes an alert worth escalating
- Recurrence. The same person triggers the same rule again in a rolling window after an earlier alert closed without action.
- Co-occurring signals. Two or more independent indicators point at the same person or drug at the same time.
- Patient-safety exposure. Missing or compromised medication for patients, such as a returned vial that may have been tampered with, which should move straight to the same-shift path.
What closes it as a false positive
- A verified, documented explanation checked against a source (the assignment sheet, the patient’s acuity, a downtime log), not the user’s word alone.
- The pattern does not recur after the next review period.
- The reviewer records the reason, and a repeated cause (for example one unit’s routine overrides) becomes a rule exclusion or a tuned threshold. Closed alerts are kept, never deleted, because a later alert may need them.
Program KPIs
Detection indicators describe people and units. Program KPIs describe the program: whether it looks at enough, closes what it opens, and is followed. Together they are the scorecard that keeps pharmacy, nursing and compliance aligned. The targets are illustrative and local; they are not hospital benchmarks, and none of them is drawn from a published study.
| KPI | Definition | Why it matters | A reasonable target (targets are local) |
|---|---|---|---|
| Controlled-substance dispenses audited | Share of controlled-substance dispenses that were screened by an automated rule or reviewed by a person in the period. | It shows how much of the activity is actually being looked at; an unreviewed transaction cannot raise an alert. | Illustrative: every dispense rule-screened, plus a documented sample reviewed by hand. The sample size is a local risk decision. |
| Discrepancy rate | Count discrepancies per 1,000 doses, by unit, plus the share resolved within the policy window. | The earliest and most common sign that a control is failing, whether through error or diversion. | Hold each unit at or below its own trailing baseline. A cross-hospital number would not transfer. |
| Median days from signal to case closure | Median calendar days from the first alert on a person or event to a recorded outcome. | Shows whether signals are worked or left to age, and how long a problem can run once seen. | Illustrative: set one figure for ordinary alerts and another for formal investigations, and report them separately. Complex cases will be longer. |
| Waste doses witnessed | Waste events with a valid, contemporaneous witness divided by all waste events. | Witnessed waste is the main control against diverting the unused portion. | As close to all as the process allows, with every exception documented. Track exceptions by reason. |
| ADC and override compliance rate | Overrides with a valid documented reason and a timely pharmacist review, divided by all overrides; plus the share of cabinet users with current access. | Shows whether the cabinet controls are working as designed or are being worked around. | Illustrative: nearly all overrides reviewed within the policy window. Units such as the ED and OR will carry more overrides by design. |
| Staff training completion | Share of staff with controlled-substance access who completed diversion training in the policy cycle, by role. | Staff are the first detector; training is how they know what to report and how. | Near 100% of staff with access, reported by role so a gap in one group is visible. |
| Investigations closed with documented outcome | Investigations that ended with a recorded outcome category and action, divided by investigations closed. | An investigation that just stops teaches nothing and cannot be defended later. | 100%. A closure with no outcome should not be possible in the case system. |
| Repeat-offender detection rate | Of people with two or more alerts in a rolling window (for example 90 days), the share escalated to review. | Repeat alerts are the clearest case for escalation, and the most likely to be lost between reviewers. | 100% of repeat-signal people reviewed. Numbers are small, so report counts next to the rate. |
The three dashboards that do the work
Each dashboard has one audience, one cadence and one decision. Putting everything on one screen is the usual way a dashboard stops being used. The analytics dashboard guide has sample SQL and layout for building the tiles, and the Power BI reference covers the data model.
A. Daily investigation queue
Audience: the diversion investigator. Cadence: every business day.
- Alerts by age. Open alerts in 0–1, 2–3 and over 3 days. Bad: anything past the triage window.
- Top clinicians by peer ratio. Ranked list of users with their ratio to the unit median. Bad: a ratio near 2x or more with real volume behind it.
- Co-occurring signals. Users flagged on two or more indicators. Bad: any user on the list at all.
- Patient exposure. Patients tied to the flagged removals and whether pain scores and administration support them. Bad: removals with no matching administration.
- Timeline for a selected user. Removals plotted against schedule and orders. Bad: removals outside shift hours or with no order.
- Open cases and next action due. Bad: an overdue next step.
Decision it drives: which alerts to open as investigations today, and who is worked next.
B. Weekly pharmacy-operations
Audience: the pharmacy manager. Cadence: weekly.
- Discrepancy rate per 1,000 doses by unit. Twelve-week trend per unit. Bad: a unit climbing against its own baseline.
- Unresolved discrepancies past window. Count and age. Bad: any older than the policy allows.
- Override rate by unit. With the top documented reasons. Bad: a rising rate with a vague or missing reason.
- Unwitnessed waste. Count by unit and drug. Bad: a unit with repeat entries.
- Returns and reverse-distribution queue. Items waiting and those that failed reconciliation. Bad: any failed reconciliation.
- Counts and audits completed. Scheduled against done. Bad: a missed cycle count.
Decision it drives: which unit or process gets a fix, extra counts or staff time this week.
C. Monthly executive scorecard
Audience: the compliance committee. Cadence: monthly.
- KPI scorecard. The eight program KPIs against local targets, with a trend arrow. Bad: more than one moving the wrong way.
- Median days, signal to closure. With the age of open cases. Bad: a rising median or cases that never close.
- Investigations by outcome. Opened and closed, split into substantiated, unsubstantiated and process failure, counts only. Bad: many opened, few closed.
- Repeat-signal escalation. People with repeat alerts and how many were reviewed. Bad: any not reviewed.
- Training completion by role. Bad: one role well below the rest.
- Reporting status. Required reports due, filed and filed on time. Bad: any filed late.
Decision it drives: whether to fund, staff or change policy, and whether the program closes what it opens. Counts only; no names.
What we would not claim
- Thresholds vary. What counts as unusual depends on the institution, the EHR and the cabinet vendor, which differ in what they record and how. The thresholds here are starting points, not standards.
- Published statistics are unreliable. Figures on how much diversion occurs describe the diversion that was detected, and most diversion is never detected, so they undercount it and say more about detection than occurrence. We give no prevalence figure for that reason.
- This is operational guidance, not legal advice. Reporting duties, employment actions and privacy rules differ by state and facility. Consult HR and legal counsel before acting on a finding.
Frequently asked questions
What dispensing frequency should trigger review?
There is no universal number. A reasonable starting point is a clinician whose controlled-substance removals per shift worked are about twice the median of peers on the same unit, role and shift type, over a rolling 30 days, with a minimum volume so that two removals against one cannot fire the rule. Tune the ratio against your own baseline, and treat the flag as a hypothesis to check against patient assignment and acuity, not as a finding.
How many KPIs should a diversion program track?
Enough to cover detection, response and compliance, and few enough that each has an owner and a decision attached. This page proposes eight program KPIs and three dashboards of five or six tiles each. If a number does not change what someone does on Monday, drop it from the scorecard and keep it in the detail data.
What is a normal discrepancy rate?
This page does not give a normal rate because no sourced benchmark is available to us, and a rate from another hospital would not transfer across different cabinets, counting rules and drug mixes. Measure discrepancies per 1,000 doses for each unit, build a trailing 90-day baseline for that unit, and review the unit when it runs at roughly twice its own median or when one person is the last user in a disproportionate share of its discrepancies.
Who should own the diversion dashboard?
One named program lead should own the data definitions across all three dashboards so a number means the same thing everywhere. The audience differs by dashboard: the diversion investigator works the daily queue, the pharmacy manager reviews the weekly operations view, and the compliance committee reviews the monthly scorecard, which should carry counts and rates, never names.
Is a flagged alert evidence of diversion?
No. An alert is a hypothesis generated by a rule. It becomes worth escalating when it recurs, when it co-occurs with other signals, or when patients are exposed to risk, and it closes as a false positive when a documented, verified explanation accounts for the pattern. Only an investigation with an evidence package produces a finding.
How quickly should an alert be reviewed?
The escalation ladder on this page uses one business day for a standard alert and the same shift where a patient-safety exposure is suspected, as illustrative starting windows. Whatever window you choose should be written into policy and measured, which is what the time-from-event-to-detection indicator and the median-days-to-closure KPI are for.
Related: 15 red flags · manual vs. automated detection · investigation playbook · case library · open data
Last reviewed: September 2026 · Content is educational, not legal advice.