Drug Diversion Investigation Playbook

PHASE 1

Immediate Response — First 4 Hours

Who to Call

Security Director — secure scene, preserve camera footage, lock down access
Pharmacy Director / Controlled Substance Officer — initiate CS inventory verification
Nursing Supervisor — reassign staff, preserve unit operations
HR Director — legal counsel coordination, union notification if applicable
Risk Management / Legal — privilege considerations, regulatory notification strategy
Hospital Administrator — executive awareness, resource authorization

What to Secure Immediately

ADC transaction logs — pull reports before they get purged or overwritten. Export raw data, not summaries.
Camera footage — flag and export footage for the relevant time window. Do not overwrite.
ADC access — temporarily restrict the subject's access if there's risk of continued diversion. Consult HR/legal first.
Physical evidence — any waste, syringes, vials, packaging in the subject's work area. Bag and tag.
Witness identification — before they leave shift or forget details. Document who was working the same shifts.

Cases that illustrate this

PHASE 2

Data Gathering — First 24-48 Hours

Essential Data Sources

ADC/Cabinet Reports: transaction log, override report, admin access log, waste log, return-to-stock log
EHR / MAR: administration records, waste documentation, pain score charting, PRN administration patterns
Scheduling: shift assignments, time cards (check for colleagues calling out when subject works)
Camera footage: time-synced footage for each transaction in question
Pharmacy records: perpetual inventory, dispense logs, delivery records, return receipts
Previous reports: any prior discrepancies, incident reports, or behavioral concerns involving the subject

Common Data-Gathering Mistakes

Pulling only summary reports instead of raw transaction data — summaries aggregate away the detail that catches diversion.
Not syncing time zones between camera system, ADC, and EHR. A 5-minute offset invalidates your timeline.
Waiting too long to export camera footage — retention limits may cause auto-overwrite.
Only looking at controlled substances — non-controlled diversion (diphenhydramine, propofol, ketorolac) won't show up in CS reports.
Not documenting the chain of custody from the moment data is pulled — if you can't prove who accessed what and when, the evidence may be inadmissible.

Cases that illustrate this

PHASE 3

Evidence Analysis & Pattern Confirmation

Building the Timeline

Create a chronological timeline of every relevant transaction, shift, and event. The timeline is the single most powerful tool for corroborating or refuting a diversion allegation.

Data Point	Source	What to Look For
Transaction pattern	ADC log	Is the subject removing CS on days/shifts they don't work? Removing under wrong patient? Multiple removals in short windows?
Override pattern	ADC override report	Override rate significantly higher than peers? Overriding when pharmacist is available? Same justification text repeated?
Waste pattern	Waste log + MAR	Waste rate higher than peers? Waste documented without witness? Waste volume consistently at odd amounts?
Administered vs. charted	MAR vs. pump log	Dose charted doesn't match pump settings? Pain scores don't change after administration? Family reports patient in pain despite charted meds?
Admin access events	Cabinet admin log	Subject using return-to-stock, inventory adjust, or override-all functions? No patient encounter association?
Camera footage	NVR system	Hands visible during cabinet access? Pocketing motions? Swapping syringes? Blocking camera view?
Behavioral reports	Incident reports, peer feedback	Colleagues expressed concern? Mood swings, frequent bathroom breaks, odor of alcohol, pupil changes?

The 3-Pattern Rule:

A single suspicious transaction can be a charting error. A single high waste day can be a bad shift. But three independent patterns pointing to the same person — data, behavior, and opportunity — is a diversion signal that demands action. Do not confront based on one data point alone.

Cases that illustrate this

PHASE 4

DEA Notification Decision

Triggers for DEA Form 106 Filing

Significant loss determination — any theft or significant loss of controlled substances, regardless of dollar value
Confirmed diversion by an employee with access to DEA-controlled substances
Missing controlled substances that cannot be accounted for after investigation
Two federal deadlines — written notice to the DEA Field Division Office within 1 business day of discovering the theft or significant loss, then DEA Form 106 filed through the Diversion Control Division secure network application within 45 days after discovery (21 CFR 1301.76(b))
State notification — most states require separate notification to the Board of Pharmacy within the same timeframe

When NOT to File (Yet)

A discrepancy that is still under active investigation — the Form 106 can wait for the facts, but the written notice cannot: it is due within 1 business day of discovering a theft or significant loss
A purely administrative discrepancy (e.g., a counting error corrected within 24 hours)
Patient-specific discrepancies that can be resolved (e.g., medication found in patient's room, documented waste not entered yet)
BUT — when in doubt, file early and amend later. Late filing is a regulatory violation itself.

Cases that illustrate this

PHASE 5

Disposition & Corrective Action

Disciplinary Process

Follow organizational policy and any collective bargaining agreement. Common outcomes: termination, suspension pending investigation, referral to state licensing board, criminal referral. Document every step.

Practitioner Health Program

Many states have non-disciplinary practitioner health programs (PHPs) for healthcare workers with substance use disorder. Referral does not replace disciplinary action but offers a recovery pathway. Document the referral and monitor participation.

Program Corrective Action

Every confirmed diversion event should trigger a control gap analysis. Ask: how did this happen despite existing controls? What control would have prevented it? Update policies, training, and surveillance accordingly.

Cases that illustrate this

Michigan Registered Nurse Summarily Suspended Over Grass Lake Drug Diversion (2026, MI)
Michigan Pharmacist Fined Over Utica Drug Diversion and Alcohol Conviction (2026, MI)
Michigan Pharmacist Fined and Probated Over Big Rapids Drug Diversion (2026, MI)
Michigan Registered Nurse Fined and Probated Over Southgate Drug Diversion (2026, MI)
Michigan Social Worker Probated Over Hamtramck Drug Diversion (2026, MI)

PHASE 6

Post-Investigation Review

Documentation Package Checklist

Investigation narrative — chronological timeline of events
Data exhibits — ADC logs, MAR records, camera footage with chain of custody
Interview notes — verbatim or summary, signed by interviewer
DEA Form 106 copy (if filed)
Corrective action plan with owner and deadline
Post-incident gap analysis

Gap Analysis Framework

Control failure: What control should have prevented this? Why didn't it?
Detection failure: How long did the diversion go undetected? Why was it not caught sooner?
Response failure: Was the initial response appropriate? Were there delays?
Systemic factors: Are there cultural or operational factors that enabled the diversion?
Improvement plan: What controls, training, or surveillance changes will close the gap?

Cases that illustrate this

Share: LinkedIn X Facebook

Last reviewed: September 2026 · Content is educational, not legal advice.

Related Resources

Interview Guide

Preparation, questioning techniques, documentation standards, and legal considerations

DEA 106 Filing Guide

When to file, step-by-step form completion, common mistakes, and sample scenarios

Patient Notification After Drug Diversion

When and how to notify patients potentially exposed through drug diversion, with bloodborne pathogen testing guidance

Reporting Employee Diversion

Reports owed when an employee diverts controlled substances: fixed federal DEA deadlines, plus board and state duties that vary by state and profession.