Is a Drug Diversion Program Required? What the Rules Say

The short answer

No federal regulation uses the words “diversion prevention program”. Several federal rules do require what a program is made of: effective controls against theft and diversion, accurate records, locked storage with limited access, and reporting of losses. A program is how you show you meet them. Your state, your accreditor or a settlement agreement may go further, and that depends on where you are and who accredits you.

Where the obligations come from

Source	What it requires	Applies to
21 CFR 1301.71(a)	“All applicants and registrants shall provide effective controls and procedures to guard against theft and diversion of controlled substances.”	Every DEA registrant
21 CFR 1301.76	No employee with access who has a felony conviction relating to controlled substances, or a DEA registration denied, revoked or surrendered for cause. Written notice of theft or significant loss within one business day of discovery, and a DEA Form 106 within 45 days.	Practitioners, including hospitals and pharmacies
21 CFR Part 1304	Initial and biennial inventories, and “a complete and accurate record” of each substance received or disposed of, kept for at least two years.	Every registrant that must keep records
42 CFR 482.25	Records of receipt and disposition of all scheduled drugs; Schedule II to V drugs locked in a secure area; only authorized personnel with access; abuses and losses reported to the pharmacy director and, as appropriate, the CEO.	Hospitals in Medicare
State pharmacy law	Can add duties for the pharmacist in charge, inventory timing and loss reporting.	Varies by state
Accreditation standards	Medication security and management standards, checked on survey.	Varies by accreditor

The regulation text is quoted from the 2025 annual edition. Accreditation standards are not quoted here; read the current manual from your accreditor.

What “effective controls” means in practice

The rules say what must be achieved, not how. When an inspector, a surveyor or your own board asks how you guard against diversion, the answer is usually a description of a program:

a named person or committee who owns it;
written policies for access, counts, waste and discrepancies;
a schedule for reviewing transactions, and a record that the reviews happened;
a written process for investigating a concern and reporting a loss;
training, so that staff know the warning signs and whom to tell.

For best practice rather than law, health systems usually work from the ASHP Guidelines on Preventing Diversion of Controlled Substances (2022), which set out a comprehensive program. They are guidelines, not regulations. The drug diversion prevention program guide maps each part to a how-to.

When a program becomes a written obligation

After an enforcement action, the program can become a term of a settlement. When Massachusetts General Hospital settled with the United States in 2015 after nurses diverted controlled substances, it adopted a corrective action plan that included enhanced diversion monitoring, annual external audits and fingerprint-based access controls on automated dispensing machines (case record). Other settlements are listed on diversion settlements and fines.

What to check for your own facility

Your state board of pharmacy rules for your setting: hospital, community pharmacy, long-term care or surgery center can each fall under different sections.
Your accreditor's current medication management standards.
Any settlement, consent order or corrective action plan your organization has signed.
Your own policies: once a policy says you will do something, a surveyor will check that you do it.

Sources

21 CFR 1301.71, 1301.76, 1304.04, 1304.11 and 1304.21; 42 CFR 482.25. 2025 annual edition.
Clark J, Fera T, Fortier C, et al. ASHP Guidelines on Preventing Diversion of Controlled Substances. Am J Health Syst Pharm. 2022;79(24):2279-2306.

Read on October 16, 2026. Educational content, not legal advice.

What the assessment checks

The hospital assessment has 8 sections. These are the 7 items it scores under Governance & Program Oversight:

Designated Diversion Prevention Officer/Coordinator with defined authority
Interdisciplinary diversion prevention committee meets quarterly (or more frequently)
Written diversion prevention policy approved by governing board
Policy addresses all controlled substance categories (II-V) and all departments
Annual program effectiveness review with documented improvements
Executive leadership receives regular diversion metrics dashboard
Non-punitive reporting culture policy documented and communicated

The other sections: Controlled Substance Lifecycle Management (9), Perioperative & Procedural Areas (6), Data Analytics & Surveillance (9), Personnel & Access Controls (8), Physical Security (7), Incident Reporting & Investigation (9), Regulatory Compliance (8). Each item is weighted, the score updates as you answer, and the result exports to PDF or CSV.

Is a Drug Diversion Prevention Program Required?

The short answer

Where the obligations come from

What “effective controls” means in practice

When a program becomes a written obligation

What to check for your own facility

Sources

Further reading

Building the program

Showing it works

What the assessment checks

Other topics

See how your program measures up