Section 5: Remediation and Compliance Follow-Up

13.5.1 The “Why”: Beyond the Investigation – The Path to Recovery and Resilience

The presentation of your meticulously compiled case file to the Diversion Oversight Committee marks the end of the investigative phase, but it is the beginning of a new, equally critical process. The work that follows a confirmed or highly suspected diversion event is what defines the ultimate success and integrity of your program. An investigation that identifies a problem but fails to address its consequences is a hollow victory. The “Why” of this section is to prepare you for this complex and challenging aftermath, which is a delicate triad of accountability, compliance, and compassion.

First, there is the imperative of accountability and patient safety. Your institution has a fundamental obligation to act decisively to prevent any further potential harm. This involves immediate, standardized actions guided by Human Resources and security protocols to contain the situation. Second, there is the non-negotiable world of regulatory and legal compliance. Federal and state laws are unambiguous about the requirement to report the theft or significant loss of controlled substances. Failure to comply carries severe penalties, including massive fines and the potential loss of the institution’s DEA registration. Your role as an analyst is to provide the precise data needed to fulfill these reporting obligations accurately and on time.

Finally, and perhaps most importantly, there is the ethical and professional obligation of compassion. Substance Use Disorder (SUD) is recognized as a chronic, treatable disease by the American Medical Association and every major medical body. While the act of diversion is a serious offense that cannot be excused, it is often a symptom of this underlying disease. A modern, ethical diversion program does not solely focus on punishment; it also seeks to provide a pathway to treatment and recovery for a colleague in crisis. This human-centered approach is not only the right thing to do, but it also fosters a culture of safety where individuals may be more likely to seek help before their actions lead to catastrophic consequences. As the pharmacy informatics analyst, you are the keeper of the objective data. You must remain impartial, but your work provides the factual foundation upon which these difficult human and regulatory decisions are made. Mastering the protocols in this section ensures that your institution responds not just forcefully, but also fairly, legally, and humanely.

13.5.2 Phase 1: The Immediate Response Protocol – Containment and Evidence Preservation

Once the Diversion Oversight Committee meets and concludes, based on your evidence-based report, that a high probability of diversion exists, a series of immediate actions must be triggered. This phase is no longer about investigation; it is about containment. The primary goals are to prevent any further potential diversion, protect patients, and preserve the integrity of all evidence for HR and potential legal proceedings. This process is led by Human Resources, in close coordination with departmental leadership (e.g., Nursing Director) and Security.

As the analyst, your direct role in this phase is minimal, but you must understand the protocol to ensure the data and evidence you’ve gathered is handed off correctly. You are the first link in a chain of custody that must remain unbroken.

13.5.3 Phase 2: The Human Element – HR Investigation and Pathways to Care

This phase addresses the individual at the center of the investigation. It is led entirely by Human Resources, who are trained professionals in conducting fair, legally compliant, and objective employee investigations. It also involves the critical step of offering resources and support, recognizing that Substance Use Disorder is a medical condition. This dual approach—investigating the policy violations while offering a path to treatment—is the hallmark of a modern, ethical, and effective program.

The Investigative Interview

HR will conduct a formal investigative interview with the employee, typically with their union representative or legal counsel present if requested. Your data is the foundation of this interview.

• Your Role: You may be asked by HR to attend the interview as a silent subject matter expert or to be “on call” to answer highly technical questions about the data. For example, if the employee claims “the Pyxis must have miscounted,” HR may turn to you to explain the ADC’s internal audit logs and barcode scanning technology that make such an error virtually impossible.
• The Goal: The purpose of the interview is to present the employee with the documented discrepancies and give them an opportunity to explain them. The HR professional will present the facts from your report objectively: “Jane, we’ve reviewed your ADC records from October. Can you help us understand this transaction on October 18th, where a 4mg vial of morphine was withdrawn, but only 2mg was documented as administered and no waste was recorded?”
• Possible Outcomes: The employee may deny everything, offer explanations that are not credible, or, in many cases, admit to the diversion and ask for help.

Offering a Pathway to Treatment: The Employee Assistance Program (EAP)

Regardless of the outcome of the investigation or the subsequent disciplinary action (which can range up to and include termination), the institution has an ethical obligation to offer help. This is typically done through the Employee Assistance Program (EAP).

Masterclass Table: Punitive vs. Supportive Institutional Responses

Element	Outdated, Purely Punitive Approach	Modern, Supportive (but Accountable) Approach
Primary Goal	Identify and terminate the “bad apple.”	Protect patient safety, hold the individual accountable for their actions, AND address the underlying disease to prevent future harm and support recovery.
Language Used	“Drug thief,” “addict,” “criminal.”	“Employee with a suspected Substance Use Disorder,” “individual in crisis.”
HR Interview	A confrontational interrogation focused solely on securing a confession for termination.	A structured, fact-based interview about the policy violations, followed by a separate, compassionate conversation about the EAP and available treatment options.
Outcome for Employee	Termination and report to law enforcement are the only outcomes considered.	Disciplinary action, up to and including termination, is determined by HR based on the severity of the offense. Independently, the employee is connected with the EAP for a confidential clinical assessment and referral to treatment.
Follow-Up	None. The employee is simply gone.	The institution may have a formal “last chance agreement” or pathway for re-entry for employees who successfully complete treatment, as permitted by state law and professional board regulations (e.g., Pharmacist Recovery Networks).

13.5.4 Phase 3: Fulfilling Regulatory and Legal Obligations

This phase runs in parallel with the HR investigation and is absolutely mandatory. Federal and state laws are explicit about the legal requirement to report controlled substance theft or “significant loss.” Failure to do so can result in severe penalties for the institution. Your role as the analyst is to provide the precise, quantitative data needed to complete these reports accurately.

The DEA Form 106: The Cornerstone of Compliance

The most important compliance document is the DEA Form 106, the “Report of Theft or Significant Loss of Controlled Substances.”

Masterclass Table: Key Sections of the DEA Form 106 & Your Data’s Role

Form 106 Section	Information Required	Your Role as the Analyst
Section II: Date and Place of Theft or Loss	The date of discovery and the type of place (e.g., Hospital/Clinic).	You provide the exact date your investigation confirmed the loss, which serves as the official “date of discovery.”
Section III: Controlled Substances Lost	A line-item list of every drug, strength, dosage form, and quantity lost. Must include NDC number.	This is your primary contribution. The “total unreconciled volume” from your audit log becomes the official quantity reported on this form. Your data must be precise and defensible.
Section IV: Individuals Associated with Theft/Loss	Information about the individual(s) believed to be responsible, if known.	HR provides this information based on the outcome of their investigation. You do not provide this.
Section V: Details of Theft or Significant Loss	A narrative explaining what happened, what security measures were in place, and what corrective actions have been taken.	You provide a concise, objective summary of your data findings, which HR will incorporate into their narrative (e.g., “An audit of ADC records revealed discrepancies between withdrawals and documentation…”).

State Board of Pharmacy and Local Law Enforcement

In addition to the DEA, reports must also be filed with other bodies.

• State Board of Pharmacy: Nearly every state requires a pharmacy/hospital to report any significant loss of controlled substances to the Board. The timeline and format vary by state, but it is a mandatory step.
• Local Law Enforcement: Your institution’s policy, guided by legal counsel, will determine when to report the matter to the local police department. This is almost always done in cases of confirmed, large-scale diversion, as it constitutes theft. The case file you prepared becomes the primary evidence provided to the police.

13.5.5 Phase 4: Closing the Loop – System Remediation and Future Prevention

The final phase of the response is to learn from the event and strengthen your defenses. A single diversion event, while unfortunate, is also a powerful learning opportunity. It can expose vulnerabilities in your workflows, policies, or technology that must be addressed to prevent future incidents. This is a proactive process, often led by a quality and safety team, with you serving as a key informatics consultant.

Root Cause Analysis (RCA)

After a major diversion event is closed, the Diversion Oversight Committee should charter a formal Root Cause Analysis (RCA). The goal of an RCA is not to assign blame, but to ask “Why?” repeatedly until the true systemic vulnerabilities are identified.

Example RCA Pathway:

• Problem: A nurse diverted 500mg of morphine over 3 months via waste discrepancies.
• Why? She was able to document waste without a witness.
• Why? The EHR allowed for waste to be documented without a required witness co-signature field for controlled substances.
• Why? The system was configured that way during the initial build five years ago to “improve workflow speed.”
• The True Root Cause: A system configuration that prioritized workflow convenience over controlled substance security.

Implementing Corrective Actions

Based on the findings of the RCA, you will be tasked with helping to design and implement corrective actions. Your informatics expertise is crucial here.

Masterclass Table: From Vulnerability to Solution

Identified Vulnerability	Potential Informatics-Based Corrective Action
Waste was being documented without a witness.	Submit a change request to the EHR team to make the “Waste Witness” field a required, hard-stop field for all controlled substance waste documentation.
Diverter frequently used ADC overrides for patients who had been discharged.	Work with the ADC and EHR vendors to implement a real-time ADT (Admission-Discharge-Transfer) interface that automatically deactivates a patient’s profile on the ADC within minutes of their formal discharge in the EHR.
A pattern of “waste buddies” was identified.	Tune the analytics software to lower the threshold for the co-occurrence algorithm, making it more sensitive to this pattern. Schedule regular, randomized audits of witnessed waste transactions on high-risk units.
The diverter was removing large-volume vials and claiming to waste most of it.	Conduct a formulary review. Can you switch to smaller vial sizes or pre-filled syringes for commonly used doses to minimize the amount of routine waste required?

By systematically identifying vulnerabilities and implementing robust corrective actions, you transform a reactive investigation into a proactive strategy for continuous improvement. This is the ultimate goal of a mature diversion prevention program: to create a system so resilient, so transparent, and so well-monitored that it becomes an increasingly difficult and undesirable environment for diversion to occur in the first place.