Section 1: Overview of Drug Diversion Risks and Patterns

13.1.1 The “Why”: Diversion as the Hidden Epidemic Within Healthcare

In your career, you have been entrusted with one of the most significant responsibilities in healthcare: the stewardship of controlled substances. This is a role you have performed with immense diligence, governed by strict laws and an unwavering ethical commitment to patient safety. You understand, better than most, the devastating potential of these medications when misused. Now, as a pharmacy informatics analyst, you will confront the most insidious threat to this stewardship: drug diversion by healthcare professionals.

This is not a simple issue of theft. Drug diversion is a complex tragedy with multiple victims. It is a hidden epidemic that compromises patient safety, destroys careers, and poses a significant threat to the integrity of the entire healthcare institution. When a clinician diverts medication, a series of catastrophic events is set in motion. The most immediate victim is the patient, who may receive a sub-therapeutic dose, leading to uncontrolled pain, or worse, be exposed to a tampered or contaminated substance. The diverter, a trusted colleague, is also a victim—often battling the disease of addiction, stress, or other overwhelming personal issues. Their actions, driven by this disease, put their health, their license, and their very life at risk. Finally, the institution itself becomes a victim, facing crippling legal liability, regulatory sanctions, and a profound loss of patient trust.

Your new role places you at the epicenter of combating this crisis. You are no longer just guarding the physical vault; you are now the guardian of the digital vault. Every transaction within the Electronic Health Record (EHR), every dispense from an Automated Dispensing Cabinet (ADC), and every waste record creates a digital fingerprint. Individually, these transactions may seem benign. In aggregate, they form patterns, and within these patterns, the subtle signatures of diversion can be found. Your professional mandate is to learn how to read this digital language. You will apply the same critical thinking and healthy skepticism you used to evaluate a suspicious prescription to evaluate millions of data points, searching for the anomalies that signal a colleague is in trouble and patients are at risk. This is one of the most challenging and impactful responsibilities in pharmacy informatics.

13.1.2 The “Who”: Deconstructing the Profile of a Healthcare Diverter

One of the first and most critical steps in understanding drug diversion is to abandon any preconceived stereotypes. The image of a shady, malicious criminal does not apply here. The healthcare professional who diverts medication is often a high-performing, well-respected colleague who is suffering in silence. They are clinicians who have dedicated their lives to caring for others, yet they are now afflicted by the disease of addiction, crippling stress, chronic pain, or overwhelming personal trauma. Their diversion is not an act of malice, but a desperate and misguided attempt to cope. This understanding is crucial because it frames our work not as a witch hunt, but as a necessary intervention to protect both patients and our struggling colleagues. Diversion can occur in any role with access to medications, but certain roles present unique risks and patterns.

The Front Line: Nurses (RNs, LPNs, CRNAs)

Nurses represent the largest group of diverters, a fact attributable not to any moral failing, but to their constant, direct proximity to medications at the point of administration. They manage the day-to-day pain, anxiety, and sedation needs of patients, creating a high frequency of access that presents a significant opportunity for diversion.

• Unrivaled Access: Nurses withdraw from ADCs, administer medications, and document waste more than any other clinician group. This high volume of transactions can make it easier to hide anomalous activity.
• Common Methods:
  • Withholding Doses: The most straightforward method. The nurse withdraws a dose for a patient, documents it as administered in the EHR, but diverts the medication for personal use. The patient receives no dose and may suffer from untreated symptoms.
  • Substitution: Administering a substitute substance (e.g., saline) to the patient while diverting the actual medication. This is particularly insidious as the EHR record appears perfect.
  • Waste Falsification: This is the single most common method of diversion. A nurse withdraws a full vial (e.g., Dilaudid 2mg) but only administers a partial dose (e.g., 1mg). They document the remaining 1mg as “wasted” but divert it. This can be done by squandering the waste into a pocketed vial instead of the sink, or by not having a witness (or a colluding/inattentive witness) for the waste.
  • PRN Abuse: Targeting patients who are sedated, confused, or non-verbal, and documenting the administration of “as needed” (PRN) medications that were never requested or given.
• Key Data Signatures:
  • An unusually high number of ADC withdrawals for controlled substances compared to peers on the same unit.
  • A high percentage of doses that are documented as “wasted.” For example, a nurse who wastes 40% of their hydromorphone withdrawals when the unit average is 15%.
  • Frequent use of the ADC “override” function to remove medications without a current order.
  • A pattern of administering PRN pain medications to multiple patients near the end of a shift.
  • Discrepancies in timing: long delays between ADC withdrawal and EHR administration.

The Procedural Experts: Physicians (Anesthesiologists, Surgeons, ED Physicians)

Physicians, particularly those in procedural areas like the operating room (OR) and emergency department (ED), have a different pattern of access. They often handle medications directly from anesthesia carts or kits, sometimes outside the direct ADC-to-EHR closed loop, creating unique vulnerabilities.

• High-Potency Access: Anesthesiologists have direct and frequent access to large vials of potent, rapid-acting opioids (Fentanyl, Sufentanil), sedatives (Propofol, Midazolam), and anesthetics (Ketamine).
• Common Methods:
  • Syringe Substitution: Pre-drawing a syringe of a controlled substance and a matching syringe of saline. The saline is administered to the patient, and the active drug is diverted.
  • “Scraping” Vials: Withdrawing the small overfill present in many vials after the intended dose is removed, accumulating a usable amount over time.
  • Falsifying Records: Over-documenting the amount of medication used during a case and diverting the difference.
  • Self-Administration: Diverting for immediate personal use in a call room, bathroom, or office due to extreme stress and burnout.
• Key Data Signatures:
  • Higher-than-average usage of specific drugs for common procedures when compared to peers (e.g., using 300mcg of fentanyl for an appendectomy when the average is 150mcg).
  • A pattern of removing whole vials or ampules from anesthesia workstations when partial doses would suffice.
  • Incomplete or delayed reconciliation of anesthesia records.
  • Frequent reports of “cracked” or “dropped” vials that require replacement.

The Guardians of the Supply: Pharmacists and Pharmacy Technicians

While less common, diversion from within the pharmacy is particularly dangerous due to the diverter’s expert knowledge of inventory management systems and their ability to cover their tracks. They have access to bulk quantities of medication before they are even assigned to a specific patient.

• Centralized Access: Access to the main pharmacy vault, carousels, and ADC stocking supplies provides the opportunity to divert large quantities.
• Common Methods:
  • Inventory Manipulation: Falsifying inventory counts, creating fake “expired drug” removals, or altering records of medications returned from the floors.
  • Shorting ADC Refills: When refilling an ADC, a technician might stock 23 tablets of oxycodone but document that they stocked the full 25, pocketing the difference.
  • IV Admixture Diversion: Withdrawing a dose of a controlled substance for an IV bag but only injecting a portion, diverting the rest. This is extremely difficult to detect without physical testing.
  • Canceling and Crediting: Creating a fake dispense for a patient, then later crediting the medication back to the system as “unused” while having already diverted the physical dose.
• Key Data Signatures:
  • Anomalous inventory adjustments or cycle counts that consistently involve controlled substances and are handled by the same individual.
  • Discrepancies between the ADC refill report and the actual ADC inventory, particularly if tied to a specific technician.
  • Unusual access patterns to the pharmacy vault or automated storage carousels (e.g., after hours, on days off).

13.1.3 The “What”: A Masterclass on High-Risk Diverted Medications

While any desirable medication can be diverted, a specific subset of drugs represents the overwhelming majority of cases. These are substances with high abuse potential, rapid onset, and easy concealability. As a pharmacist, you are already an expert in the pharmacology of these agents. Now, you must view them through the lens of a diversion investigator, understanding not just their clinical effects, but their “street value” within the hospital, their typical methods of diversion, and the specific data trails they leave behind.

Masterclass Table: The Diversion “Top Hits” List

Drug Class & Examples	Pharmacologic Appeal for Diversion	Common Formulations & Diversion Methods	Key Data Signatures to Monitor
Injectable Opioids Fentanyl Hydromorphone (Dilaudid) Morphine Meperidine (Demerol)	Rapid, intense euphoria. Short half-life requires frequent re-dosing, driving repeated acts of diversion. Small volumes are potent and easy to conceal in a syringe. Fentanyl is a particular focus in OR/procedural settings.	Vials & Pre-filled Syringes: Waste Diversion: The #1 method. A 2mg/mL vial of Dilaudid is used for a 0.5mg order. The remaining 1.5mg (0.75 mL) is documented as waste but diverted. Substitution: Withdrawing the vial contents and replacing with saline. The tampered vial is then returned to the ADC or used on a patient.	High waste-to-dispense ratio compared to peers. Frequent dispenses of full vials for small ordered doses. Anesthesia records showing high µg/kg/hr usage. Patterns of administering PRNs right before a shift ends.
Oral Opioids Oxycodone (esp. immediate-release) Hydrocodone/APAP Hydromorphone	High street value for resale, or for personal use where the user prefers an oral route. Longer-lasting effect than injectables.	Tablets & Capsules: ADC Discrepancies: Diverting during a miscount or by shorting a refill. The most direct form of theft. Post-Discharge Dispenses: Withdrawing doses for a patient who has already been discharged from the hospital. “Dropped” Pills: Claiming a tablet was dropped and is irretrievable, then obtaining a replacement dose while diverting the original.	Unresolved ADC count discrepancies tied to a single user. Medication dispenses timestamped after the patient’s discharge order. High rates of “damaged” or “dropped” dose reports. Users who frequently refill/restock these specific medications.
Benzodiazepines Lorazepam (Ativan) Midazolam (Versed) Alprazolam (Xanax)	Potent anxiolytic and sedative effects. Often used to potentiate the euphoric effects of opioids or to self-medicate for anxiety and stress.	Injectable & Oral Forms: Methods are very similar to opioids (waste diversion for injectables, ADC theft for oral solids). Midazolam is a key target in procedural areas, often diverted alongside fentanyl.	Monitor users with high dispense rates of BOTH opioids and benzodiazepines. This dual pattern is a major red flag. Excessive PRN “anxiety” medication administrations. Look for high usage on units where sedation is common (e.g., ICU, ED).
Anesthetics / Sedatives Propofol (Diprivan) Ketamine	Propofol: Intense, brief euphoria upon administration. Highly addictive despite its risks. Ketamine: Potent dissociative and hallucinogenic effects. Both are primarily found in procedural areas.	Vials & Infusion Bags: Leftover Diversion: Diverting the remaining volume from a large propofol vial after a case is finished. Syringe Swaps: Drawing up the drug for personal use while documenting it was for the patient.	Extremely difficult to track via standard analytics due to procedural workflow. Often requires physical audits and surveillance. Focus on discrepancies in anesthesia reconciliation records and high per-case usage outliers.

13.1.4 The “How”: A Taxonomy of Diversion Methods and Their Digital Footprints

Understanding the specific tactics used to divert drugs is the core of forensic analysis. Each method, or “modus operandi,” is a unique strategy designed to defeat the medication-use process safeguards. Crucially, each method also leaves a distinct, traceable digital footprint in the hospital’s information systems. Your job is to learn to recognize these footprints. This is where your pharmacist’s knowledge of workflows intersects with the skills of a detective.

1. Substitution & Tampering: The Attack on Product Integrity

This is one of the most dangerous forms of diversion because it involves a direct act of adulteration, creating a high risk of patient harm through under-dosing and contamination.

• The Method: The diverter uses a syringe to remove the active drug from a vial or IV bag and replaces it with an equal volume of a clear, inert liquid like normal saline or sterile water. The tampered product is then returned to circulation, appearing perfectly normal to the next user. This can be done with single vials, patient-specific IV bags, or even by tampering with large-volume PCA or epidural infusions.
• Clinical Impact: Catastrophic. Patients receive no therapeutic effect, leading to uncontrolled pain, agitation, or awareness during surgery. It also introduces a significant risk of bloodstream infections if non-sterile liquids or needles are used.
• Digital Footprint: This method is notoriously difficult to detect through standard data analytics alone because the electronic records often look perfect. The drug was dispensed, documented, and the container was returned or discarded. Detection often relies on:
  • Cluster Analysis: Identifying a statistically significant number of patients under the care of a single clinician who are reporting poor pain control or requiring escalating doses of analgesics without effect. This requires linking pharmacy data with clinical outcomes data (e.g., pain scores).
  • Targeted Audits: If a clinician is suspected, the pharmacy can “mark” vials or bags sent to their unit and have them returned for laboratory testing (refractive index or mass spectrometry) to confirm the contents.

2. Falsification of Records: The Attack on Documentation Integrity

This is the most common category of diversion and the most detectable by informatics. The diverter obtains the drug legitimately but creates a false electronic record to account for it. This is a direct assault on the truthfulness of the MAR and ADC logs.

• The Method: The Unwitnessed or “Drive-By” Witnessed Waste.
  1. Nurse A needs to waste 2mg of morphine.
  2. Nurse A finds a busy colleague, Nurse B, and says “Hey, can you witness my waste?”
  3. Nurse B, trusting their colleague and wanting to be efficient, enters their credentials into the ADC or EHR without actually watching Nurse A physically waste the drug.
  4. Nurse A documents the waste but pockets the drug. The electronic record is perfect, showing both a primary user and a witness.
• Digital Footprint of Waste Fraud:
  • High Waste Percentage: The diverter will have a significantly higher percentage of their controlled substance transactions resulting in waste compared to their peers on the same unit. This is a fundamental, high-yield metric.
  • The “Waste Buddy” Pattern: Two clinicians who disproportionately witness waste for each other. A query to find pairs of users with high co-signing frequencies can reveal collusive behavior or a “duped” witness.
  • Delayed Wasting: A long time gap between the initial medication withdrawal/administration and the documentation of the waste. This may indicate the diverter is waiting for an opportune moment or a specific colleague to witness.
  • Waste Without Administration: A medication is withdrawn from the ADC, and the entire amount is documented as wasted without any dose being administered to the patient. While sometimes legitimate (e.g., patient refused after prep), a pattern of this is a major red flag.

Other Falsification Methods:

• The Ghost Patient: Withdrawing medication under the name of a patient who has been discharged or has recently expired. The system allows the withdrawal, but the drug is never administered.
  • Digital Footprint: A simple but powerful report: “Medication Withdrawals After Patient Discharge/Deceased Timestamp.” This should always be zero.
• The Duplicate Dispense: Documenting a medication was dropped, damaged, or refused by the patient, then getting a replacement dose from the ADC or pharmacy while diverting the original.
  • Digital Footprint: A report flagging users with a high number of “returned,” “damaged,” or “refused” transactions for controlled substances.

3. Process & Workflow Abuse: The Attack on System Safeguards

This category involves using legitimate system functions in inappropriate ways to bypass safety checks and enable diversion.

• The Method: Excessive Overrides. The ADC override function is a necessary tool for true emergencies, allowing removal of a drug before pharmacy profile verification. A diverter will abuse this function to obtain drugs for which there is no order, often using a vague justification.
  • Digital Footprint: A ranked report of users by override frequency. Anyone in the top percentile is an immediate candidate for an audit. The report should include the drug, the patient, and the reason entered for the override.
• The Method: Timing Manipulation. Withdrawing all of a patient’s scheduled and PRN pain medications at the very beginning of a shift (“hoarding”), rather than as they are needed. This gives the diverter a “stockpile” from which they can divert throughout the day, making it harder to link a specific withdrawal to a specific missed dose.
  • Digital Footprint: Measuring the “delta time” between ADC withdrawal and EHR administration. Diverters will have a significantly longer average delta time than their peers, often measured in hours instead of minutes.
• The Method: Dispense Discrepancy Abuse. An ADC drawer fails to open or a count is incorrect. A diverter may frequently report such discrepancies to create confusion in the inventory counts, which they can then exploit to steal medication.
  • Digital Footprint: A report of users who generate the most ADC discrepancy reports. While often legitimate, a user who is a statistical outlier warrants investigation.

13.1.5 Synthesizing the Evidence: Correlating Behavioral Red Flags with Data Signatures

The most effective diversion monitoring program does not rely on data alone. It combines sophisticated data analytics with astute, on-the-ground observation from managers and colleagues. Often, a behavioral concern is the first sign that something is wrong, and the data is then used to confirm or deny that suspicion. Conversely, a data anomaly may be the first flag, prompting managers to pay closer attention to a specific individual. Your role as the analyst is to understand both sides of this coin and to provide clear, objective data that helps managers interpret the behaviors they are seeing.

Masterclass Table: Bridging the Gap Between Behavior and Data

Behavioral Red Flag (Observed by Colleagues/Managers)	Potential Data Signature (Investigated by the Analyst)	Analyst’s Investigative Question
Comes in early, stays late, skips breaks, volunteers for extra shifts, especially on units with high controlled substance use.	ADC and EHR access records show activity outside of scheduled shift hours. High volume of transactions at the very beginning or end of shifts.	“Does this user’s transaction timeline correlate with their scheduled hours? Are they performing high-risk transactions when fewer people are around?”
Frequently offers to administer pain medications or witness waste for colleagues. May carry the “narc keys” for the unit.	A high number of “co-sign” or “witness” events in the logs. May appear as a witness for multiple other users who are later found to have discrepancies.	“Is this user a ‘waste buddy’? Let’s run a co-signing frequency report to see who they most often witness for, and if those users also have anomalous patterns.”
Patients assigned to this clinician consistently complain of poor pain control, despite documented administrations.	Analysis of pain score data (if available) shows a lower average reduction in pain scores for this clinician’s patients compared to the unit average. High PRN medication usage for their patients.	“Can we correlate ADC withdrawal data with documented pain scores? Is there a disconnect where drugs are being pulled but pain isn’t improving?”
Exhibits mood swings, irritability, or excessive sweating. May appear euphoric or sedated. Makes frequent, long trips to the bathroom or locker room.	Gaps in electronic activity. A user who is logged into the EHR may have no activity for 30-45 minutes, followed by a flurry of charting. Timing of these gaps may correlate with controlled substance withdrawals.	“Are there unexplained ‘dead zones’ in this user’s electronic footprint, particularly after they handle controlled substances?”
Sloppy charting, increased medication errors, and general decline in job performance. Forgets to waste medications until hours later.	High rate of charting corrections/amendments for MAR entries. Long delta times between administration and waste documentation. Possible increase in safety reports linked to the user.	“What is the user’s average time-to-waste? How does it compare to their peers? Do their MAR entries require frequent modification?”
Is defensive or evasive when questioned about discrepancies. May blame the ADC, the pharmacy, or other staff for errors.	A high number of resolved ADC discrepancies, often with non-specific notes like “miscounted.” The user’s notes may consistently deflect responsibility.	“Let’s trend all discrepancy reports by user and by resolution note. Does this user generate more discrepancies than others, and are their explanations credible?”