Patient Notification After Drug Diversion
When and how to notify patients potentially exposed through drug diversion — public health coordination, bloodborne pathogen testing, and the notification decision framework.
Drug diversion does not always harm only the diverter. When healthcare workers divert injectable medications by substituting saline, tap water, or other solutions — or by self-administering from syringes later given to patients — patients may be exposed to blood-borne pathogens. CDC investigations linked to healthcare worker diversion have identified nearly 30,000 patients as potentially exposed and targeted for notification. Patient notification is a critical, time-sensitive, and emotionally complex part of any diversion response.
When Notification Is Triggered
Not every diversion event requires patient notification. The need depends on the diversion mechanism and the exposure pathway. Notification is most clearly indicated when:
- Injectable medications were tampered with or substituted — a healthcare worker withdrew controlled substances from vials and replaced the volume with saline, water, or another substance. Patients who received medication from those vials were exposed to whatever was substituted, and potentially to blood-borne pathogens if the diverter was infected and used contaminated technique.
- Syringes or IV equipment were used by the diverter — a diverter who self-administered from a syringe that was then given to a patient, or vice versa, creates a direct exposure pathway.
- The diverter tests positive for a blood-borne pathogen — a confirmed hepatitis C, hepatitis B, or HIV result in the implicated healthcare worker makes exposure plausible for any patient who received medications handled by that individual during the relevant period.
- An outbreak investigation identifies a likely source — when multiple patients develop a blood-borne infection and epidemiological investigation links them to a common healthcare worker or setting, notification may be necessary even before the diversion mechanism is fully established.
Diversion that involved only pill theft, inventory manipulation, or substitution of non-injectable medications generally does not trigger patient notification, because the patient exposure pathway does not exist. The need for notification is best assessed in consultation with the local or state health department, guided by the mechanism of diversion and the results of the implicated professional's testing.
Immediate Actions in the First Hours
When diversion with potential patient exposure is confirmed or strongly suspected, the first hours are critical for preserving evidence and preventing ongoing harm.
Secure Access Immediately
Remove the implicated individual from patient care and controlled substance access. Do not wait for investigation completion. Continued access prolongs both patient risk and evidentiary contamination. Document the time and circumstances of access removal.
Screen the Suspected Individual — Promptly
The person suspected of diversion should be screened for blood-borne pathogens (hepatitis B, hepatitis C, HIV) and undergo toxicology testing, ideally before leaving the premises. Time is critical: toxicology results fade and delay weakens the evidentiary record. Consult HR and legal counsel on the consent process before proceeding.
Preserve Physical Evidence
Segregate and preserve any medication vials, syringes, IV bags, or dispensing cabinet contents associated with the implicated individual or area. Do not destroy or return to stock. Chain-of-custody documentation begins immediately. Pharmacy, security, and legal should coordinate from the outset.
Secure Electronic Records
Pull and preserve dispensing cabinet transaction logs, medication administration records, camera footage, and scheduling data for the relevant period — which may extend weeks or months before discovery. Coordinate with IT to prevent records from being overwritten by routine retention cycles.
Engaging Public Health
Diversion with potential patient exposure is a public health event, not solely an internal HR or compliance matter. State and local health departments — specifically their healthcare-associated infections (HAI) programs — have the authority, expertise, and infrastructure to lead or co-lead patient notification.
Contact your state or local health department's HAI program promptly. Early engagement allows public health to:
- Provide epidemiological guidance on the scope of the patient population that may have been exposed
- Assess the exposure mechanism and the probability of transmission
- Coordinate notification logistics, including outreach to patients across multiple contact points
- Access CDC resources, including the CDC Injection Safety Patient Notification Toolkit, which provides specific guidance for public health departments and healthcare facilities notifying patients of potential exposure to an infectious pathogen or an infection control lapse
- Support media relations strategy if the incident becomes public
Diversion with potential patient exposure should be reported to the state or local health department (HAI program) in addition to DEA's one-business-day preliminary theft/loss notification under 21 C.F.R. §1301.76(b). These are parallel obligations — meeting one does not fulfill the other.
Who Decides and What the Notification Should Say
The decision about whether and how to notify patients is made jointly by the healthcare facility and the public health authority. The facility does not make this determination unilaterally, and notification should not be delayed pending internal investigation completion.
The CSTE (Council of State and Territorial Epidemiologists) HAI Drug Diversion Planning and Response Toolkit (2019) includes sample patient notification letters covering four scenarios:
Scenario 1 — Outbreak Investigation
Used when patients are contacted because of a known or suspected epidemiological link to a cluster of infections. Explains the investigation context without prejudging the source.
Scenario 2 — Repeat Testing
Used when previously tested patients are asked to return for follow-up testing at a later window period, after an initial round of notification has already occurred.
Scenario 3 — Known BBP Risk
The implicated healthcare worker has tested positive for a blood-borne pathogen. Patients are notified of a confirmed exposure risk and offered testing with direct clinical context.
Scenario 4 — Unknown BBP Risk
Diversion is confirmed but the healthcare worker's blood-borne pathogen status is unknown — testing refused, result pending, or exposure period undetermined. Notification proceeds with appropriate uncertainty framing.
Notification letters should be written in plain language, explain what happened and why the patient is being contacted, clearly state what action the patient should take (testing, follow-up contact), identify who to call with questions, and avoid premature conclusions about the patient's actual infection status.
Offering and Documenting BBP Testing
Patients believed to have been put at risk should be notified promptly and offered bloodborne pathogen testing. The standard panel includes:
- Hepatitis B — hepatitis B surface antigen (HBsAg) and surface antibody (anti-HBs), with core antibody (anti-HBc) in higher-risk scenarios
- Hepatitis C — hepatitis C antibody (anti-HCV), with reflex to HCV RNA for reactive results
- HIV — fourth-generation HIV-1/2 antigen/antibody combination assay
Baseline testing should be offered promptly. Depending on exposure timing and window periods, repeat testing at three to six months may be recommended by public health authorities. All testing offered — and patient responses, including refusals — should be documented. Facilities should arrange a mechanism for patients to access testing and cover the cost; this is standard practice and is expected by patients and health departments alike.
Hepatitis C antibody may take 8–11 weeks to appear after infection. HIV fourth-generation assays detect most infections within 18–45 days. A negative result at the time of initial notification does not rule out infection if the exposure was recent. Public health will advise on repeat testing schedules based on exposure timing.
Coordination with DEA Reporting and the Investigation
Patient notification and DEA reporting run on parallel but distinct timelines. Keeping them coordinated — without conflating them — matters for compliance and legal defensibility.
DEA Preliminary Notification
Report theft or significant loss to your local DEA field division office in writing within one business day of discovery (21 C.F.R. §1301.76(b)). This is separate from DEA Form 106 and does not require investigation completion.
DEA Form 106
Complete DEA Form 106 electronically within 45 days of discovery. Document what is known and note that the investigation is ongoing if applicable. The investigation does not need to be resolved before filing.
State Health Department Reporting
Notify your state or local health department's HAI program. Independent of DEA reporting, many states have mandatory healthcare-associated infection or infection control lapse reporting requirements triggered by healthcare worker diversion with patient exposure.
State Licensing Board
State licensing board notification for the implicated practitioner is typically required by law, on a timeline that varies by state. Confirm requirements with legal counsel. Board notification and DEA registration reporting obligations may overlap but are legally distinct.
Public statements, media responses, and patient communications should be coordinated carefully. Premature or inconsistent statements can undermine the investigation and create legal liability. Involve legal, compliance, communications, and public health in a unified response team from the outset.
Next Steps
The investigation playbook covers the full diversion response from initial report through DEA filing. Use the hospital checklist to assess your current patient safety and notification readiness.
Last reviewed: September 2026 · Content is educational, not legal advice.