Drug Diversion Investigation Playbook

PHASE 1

Immediate Response — First 4 Hours

Who to Call

Security Director — secure scene, preserve camera footage, lock down access
Pharmacy Director / Controlled Substance Officer — initiate CS inventory verification
Nursing Supervisor — reassign staff, preserve unit operations
HR Director — legal counsel coordination, union notification if applicable
Risk Management / Legal — privilege considerations, regulatory notification strategy
Hospital Administrator — executive awareness, resource authorization

What to Secure Immediately

ADC transaction logs — pull reports before they get purged or overwritten. Export raw data, not summaries.
Camera footage — flag and export footage for the relevant time window. Do not overwrite.
ADC access — temporarily restrict the subject's access if there's risk of continued diversion. Consult HR/legal first.
Physical evidence — any waste, syringes, vials, packaging in the subject's work area. Bag and tag.
Witness identification — before they leave shift or forget details. Document who was working the same shifts.

PHASE 2

Data Gathering — First 24-48 Hours

Essential Data Sources

ADC/Cabinet Reports: transaction log, override report, admin access log, waste log, return-to-stock log
EHR / MAR: administration records, waste documentation, pain score charting, PRN administration patterns
Scheduling: shift assignments, time cards (check for colleagues calling out when subject works)
Camera footage: time-synced footage for each transaction in question
Pharmacy records: perpetual inventory, dispense logs, delivery records, return receipts
Previous reports: any prior discrepancies, incident reports, or behavioral concerns involving the subject

Common Data-Gathering Mistakes

Pulling only summary reports instead of raw transaction data — summaries aggregate away the detail that catches diversion.
Not syncing time zones between camera system, ADC, and EHR. A 5-minute offset invalidates your timeline.
Waiting too long to export camera footage — retention limits may cause auto-overwrite.
Only looking at controlled substances — non-controlled diversion (diphenhydramine, propofol, ketorolac) won't show up in CS reports.
Not documenting the chain of custody from the moment data is pulled — if you can't prove who accessed what and when, the evidence may be inadmissible.

PHASE 3

Evidence Analysis & Pattern Confirmation

Building the Timeline

Create a chronological timeline of every relevant transaction, shift, and event. The timeline is the single most powerful tool for corroborating or refuting a diversion allegation.

Data Point	Source	What to Look For
Transaction pattern	ADC log	Is the subject removing CS on days/shifts they don't work? Removing under wrong patient? Multiple removals in short windows?
Override pattern	ADC override report	Override rate significantly higher than peers? Overriding when pharmacist is available? Same justification text repeated?
Waste pattern	Waste log + MAR	Waste rate higher than peers? Waste documented without witness? Waste volume consistently at odd amounts?
Administered vs. charted	MAR vs. pump log	Dose charted doesn't match pump settings? Pain scores don't change after administration? Family reports patient in pain despite charted meds?
Admin access events	Cabinet admin log	Subject using return-to-stock, inventory adjust, or override-all functions? No patient encounter association?
Camera footage	NVR system	Hands visible during cabinet access? Pocketing motions? Swapping syringes? Blocking camera view?
Behavioral reports	Incident reports, peer feedback	Colleagues expressed concern? Mood swings, frequent bathroom breaks, odor of alcohol, pupil changes?

The 3-Pattern Rule:

A single suspicious transaction can be a charting error. A single high waste day can be a bad shift. But three independent patterns pointing to the same person — data, behavior, and opportunity — is a diversion signal that demands action. Do not confront based on one data point alone.

PHASE 4

DEA Notification Decision

Triggers for DEA Form 106 Filing

Significant loss determination — any theft or significant loss of controlled substances, regardless of dollar value
Confirmed diversion by an employee with access to DEA-controlled substances
Missing controlled substances that cannot be accounted for after investigation
1 business day rule — DEA Form 106 must be filed within 1 business day of discovering the significant loss
State notification — most states require separate notification to the Board of Pharmacy within the same timeframe

When NOT to File (Yet)

A discrepancy that is still under active investigation — you have 1 business day from determination of significant loss, not from initial discovery
A purely administrative discrepancy (e.g., a counting error corrected within 24 hours)
Patient-specific discrepancies that can be resolved (e.g., medication found in patient's room, documented waste not entered yet)
BUT — when in doubt, file early and amend later. Late filing is a regulatory violation itself.

PHASE 5

Disposition & Corrective Action

1

Disciplinary Process

Follow organizational policy and any collective bargaining agreement. Common outcomes: termination, suspension pending investigation, referral to state licensing board, criminal referral. Document every step.

2

Practitioner Health Program

Many states have non-disciplinary practitioner health programs (PHPs) for healthcare workers with substance use disorder. Referral does not replace disciplinary action but offers a recovery pathway. Document the referral and monitor participation.

3

Program Corrective Action

Every confirmed diversion event should trigger a control gap analysis. Ask: how did this happen despite existing controls? What control would have prevented it? Update policies, training, and surveillance accordingly.

PHASE 6

Post-Investigation Review

Documentation Package Checklist

Investigation narrative — chronological timeline of events
Data exhibits — ADC logs, MAR records, camera footage with chain of custody
Interview notes — verbatim or summary, signed by interviewer
DEA Form 106 copy (if filed)
Corrective action plan with owner and deadline
Post-incident gap analysis

Gap Analysis Framework

Control failure: What control should have prevented this? Why didn't it?
Detection failure: How long did the diversion go undetected? Why was it not caught sooner?
Response failure: Was the initial response appropriate? Were there delays?
Systemic factors: Are there cultural or operational factors that enabled the diversion?
Improvement plan: What controls, training, or surveillance changes will close the gap?