INTRODUCTION

Meet Charlie. Charlie is a newly licensed pharmacist who is excited to start his new job at a busy community pharmacy. During his training, a more experienced coworker, Hazel, instructs Charlie to override insurance claim rejections. She shows him the prior authorization override code to submit claims. She tells him, “You don’t actually need to contact the prescriber and have them obtain prior authorization for it to work. It’s just a workaround everyone does.”

The next day, the insurance program rejects a prescription for Reimbursitol because it requires prior authorization. Its cash price is more than $1,000, and Charlie dreads informing the patient. Hazel tells Charlie to enter the override code, even though they have not contacted the provider and the insurer has not approved the prior authorization. The claim goes through, and the pharmacy receives payment for Reimbursitol. Charlie is eager to fit in and lacks experience, and this workaround streamlines his workflow, so he follows this process for several prescriptions over the next few weeks.

Healthcare fraud imposes an enormous burden on the healthcare system. Experts estimate that fraud accounts for 3% to 10% of healthcare expenses annually, resulting in billions of dollars lost each year.¹ In 2024, the United States (U.S.) spent $5.3 trillion on healthcare, or about $15,474 per person. A large share of this spending was divided among the following²

• Medicare: $1,118 billion (21%)
• Medicaid: $932 billion (18%)
• Private health insurance: $1,645 billion (31%)
• Out-of-pocket spending: $557 billion (11%)

Based on these figures, fraud could account for losses of $159 billion to $530 billion in just one year.

Not only does fraud affect healthcare on a national level, but it directly impacts pharmacies. For example, in 2019, an independent pharmacy chain allegedly submitted false claims to Medicare and Medicaid for prescription medications by switching from a lower cost to a higher cost product without a medical need or prescription. Investigators allege that pharmacy staff switched patients from an inexpensive to an expensive medication and billed federal healthcare programs for reimbursement of the high-cost item. This change in therapy inflated the complexity of the product dispensed, which was not medically necessary and resulted in larger reimbursement payments, In some cases, the pharmacy dispensed the expensive item and billed federal payors without a valid prescription. The case resolved in 2022 with the pharmacy paying $2.05 million and implementing training programs regarding fraud and compliance.^3,4

The water can sometimes seem muddy when it comes to billing practices and legal regulations. Understanding the laws and regulations that govern healthcare can enable pharmacy team members to identify, report, and prevent fraud and abuse, rather than falling victim to unsavory practices.

FRAUD, ABUSE, AND WASTE: WHAT'S THE DIFFERENCE?

Although fraud, waste, and abuse are often grouped together, each carries a distinct definition, intent standard, and regulatory implication.

Fraud is an intentional deception or misrepresentation that could result in an unauthorized benefit. It is intentionally wrongful and considered criminal.^5,6 An example of fraud is billing for services that were not provided.⁷

Abuse is provider practices that are inconsistent with accepted practices, resulting in an unnecessary cost to the health care system. There is usually not criminal intent, but it still leads to financial loss by the payor.^5,6 An example of abuse is billing for medically unnecessary services.⁷

Waste is misuse or inappropriate use of resources that results in unnecessary costs to the healthcare system. It is not associated with deceptive intentions.⁶ An example of waste is ordering excessive or unnecessary tests or services.

See the SIDEBAR for a quick overview of additional law terminology.

SIDEBAR: A (Very) Brief Law Terminology Refresher^8,9

Law: A broad term for all rules that govern conduct, such as statutes, ordinances, and regulations. For example, the Controlled Substance Act is a federal law regulating agents with potential for abuse.

Act or statute: Both refer to a specific type of law. An act is a formal, written law passed by a legislative body, such as Congress or state legislature. A statute refers to the written law itself, typically as it is codified in the U.S. Code. For example, the False Claims Act began as a bill in January 1863. When President Lincoln signed it in March 1863, it became law. It is currently published in the official U.S. federal code as 31 U.S.C. §§ 3729–3733.

Ordinance: A local law in place to ensure public safety, health, and general welfare. Ordinances often regulate fire and safety regulations, housing standards, parking regulations, snow removal, littering, public streets and sidewalks, and zoning. Examples of ordinances pertaining to pharmacy include zoning, signage, and operating hours.

Regulation: A rule issued by administrative agencies that have legislative authority over a specific area to enforce rules or statutes. For example, the state board of pharmacy may regulate how many CE hours pharmacists and technicians must complete each year, or for how many years documentation must remain on the pharmacy premises.

Table 1 offers a brief side-by-side look at civil versus criminal law.

Table 1. Overview of Criminal Law vs. Civil Law^10,11,12

*Burden of proof is the responsibility to present enough evidence to win the case and meet the applicable legal standard. It usually lies with the party initiating the case. In other words, the prosecutor or plaintiff must find the defendant guilty rather than the defendant proving their innocence.

COMPLIANCE IN ACTION: FEDERAL LAWS AND REGULATIONS

Several federal laws and regulations are in place to prevent and address fraud. The False Claims Act (FCA), Anti-Kickback Statute (AKS), Physician Self-Referral Law (Stark Law), and HIPAA establish important compliance requirements for healthcare.

False Claims Act (FCA)

The FCA (FCA; 31 U.S.C. §§ 3729–3733) is a civil federal statute dating back to 1863 in response to contractor fraud during the American Civil War.¹³ Still in effect today, the FCA allows the federal government to recover losses through civil lawsuits for false or fraudulent claims, seek financial penalties, and pursue criminal charges for that conduct.¹⁴

Knowingly submitting false claims or conspiring to submit false claims violates the FCA.¹³ In the healthcare setting, the FCA applies whenever a federal payor is involved, such as Medicare or Medicaid. Examples of healthcare-related FCA violations include submitting false or fraudulent claims for payment, billing for services not rendered, and upcoding (billing for a more expensive service than was actually obtained by the patient).¹⁵

Civil liability under the FCA does not require a specific intent to defraud. In its definition, the FCA uses the term “knowingly” to include individuals who knew the claim was false, deliberately ignored that it was false, or ignored signs that it was false. Violations carrying civil liability consist of recklessness or deliberate ignorance and do not require intent. In other words, an individual who “looks the other way” or “should have known” may be violating the FCA.¹⁶

Civil penalties under the FCA are up to three times the government’s loss plus inflation-related fines ($11,000 for Medicare or Medicaid fraud) per claim. Because each item or service billed counts as a claim, losses and fines can accumulate quickly.¹⁶ The FCA includes a whistleblower provision (“qui tam”), which allows private citizens to submit a claim on the government's behalf for a share of recoveries, usually between 15% to 30%.³ Whistleblowers can be business partners (current or former), hospital or office staff, patients, or competitors.^13,16

In addition to seeking civil penalties under the FCA, the government may also bring criminal charges where appropriate. More severe cases — those with intentional fraud — may face criminal prosecution. Criminal penalties include imprisonment and criminal fines.¹⁶

Anti-Kickback Statute (AKS)

The AKS (AKS; 42 U.S.C. § 1320a-7b(b)) ensures that healthcare providers make clinical decisions objectively and appropriately based on patient need, not financial incentive. This federal criminal law prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to entice or reward referrals. It also prohibits creating federal healthcare business involving items or services that are reimbursable by programs like Medicare, Medicaid, or other federal health programs. Remuneration is considered anything of value, and in this instance, it covers a wide range. Examples include–but are not limited to–free rent, hotel stays, meals, bribes, rebates, and excessive compensation.¹⁶

The AKS applies to both the party offering the kickback and the party receiving it. This means that it is illegal to accept payment for referring patients, and it is illegal to pay to have patients referred.¹⁶

AKS violations carry both criminal and civil penalties that can be extensive and overlapping. Violations of the AKS are classified as felony crimes under federal law and can result in jail time.¹⁶ Criminal penalties can include fines up to $25,000 per violation and/or up to a 5-year prison term. Civil penalties fall under the Civil Monetary Penalties Law and carry penalties of up to $50,000 per kickback plus up to three times the remuneration value.

Furthermore, AKS violations may also create liability under the FCA and incur the penalties associated with FCA violations. In addition to the criminal and civil penalties, AKS violations can result in ineligibility to participate in federal health care programs.^14,16

Physician Self-Referral Law (Stark Law)

The Physician Self-Referral Law (42 U.S.C. § 1395nn), often called the Stark law, is a civil law that prohibits physicians from referring Medicare or Medicaid patients for designated health services (DHS) to parties with which the physician or an immediate family member has a financial relationship, unless an exception applies. Simply put, physicians should not profit by referring patients to services in which they have a financial stake.¹⁶ See Table 2 for a list of DHS.

Table 2. Stark Law Designated Health Services (DHS)¹⁷

The Stark law is a strict liability statute, meaning that a violation can exist even without specific intent to break the law. Any violation—even an accidental one—is a violation of the Stark law.¹⁶

Civil penalties include fines and ineligibility to participate in federal healthcare programs.¹⁶ Although the Stark law addresses physician referrals, pharmacists and technicians may be indirectly affected. For example, if a physical refers Medicare or Medicaid patients to a pharmacy which he or she has a financial interest, it may violate the Stark law, unless an exception applies. A complete list of regulatory exceptions to the Stark Law is beyond the scope of this activity; however, exceptions that may apply to a pharmacy setting include the in-office ancillary services exception, bona fide employment relationships, and fair market value compensation arrangements.^18,19 Pharmacy team members can contact their legal or compliance departments if concern exists regarding Stark Law and/or its exceptions.

Health Insurance Portability and Accountability Act (HIPAA)

While HIPAA is often perceived as primarily protecting patient privacy, it includes fraud provisions. It is a crime to knowingly use, obtain, or disclose protected health information (PHI). Criminal penalties for HIPAA violations, addressed under 42 U.S.C. § 1320d–6, can be substantial and vary depending on the nature and extent of the violation. A basic violation can result in fines up to $50,000 and/or up to 1 year in prison. When committed under false pretenses, the fines increase to no more than $100,000 and/or up to 5 years in prison. The intent to sell, transfer, or use PHI for personal gain increases the fines even further to a maximum of $250,000 and/or 10 years in prison.^20,21

Understanding the functions of key regulatory bodies can illustrate the many moving parts involved in governing healthcare. The SIDEBAR summarizes these organizations briefly.

SIDEBAR: Regulatory and Enforcement Agencies ^7,22-27

The U.S. Department of Justice (DOJ) is the federal agency responsible for ensuring justice. It enforces federal laws, prosecutes cases, oversees federal law enforcement agencies such as the FBI and DEA, and manages prisons. The DOJ is headed by the Attorney General.

The Federal Bureau of Investigation (FBI) reports to the DOJ. It enforces federal criminal law and conducts investigations, and can investigate corruption, fraud, and organized crime.

The U.S. Drug Enforcement Administration (DEA) enforces controlled substance laws and regulations, including the manufacture and distribution of controlled prescription drugs.

The Office of the Inspector General (OIG) is a federal agency that aims to counteract fraud, abuse, and waste while maximizing efficiency and accountability in the Department of Health and Human Services programs. The OIG can audit, investigate, and inspect federal programs, especially Medicare and Medicaid programs, which comprise a large portion of the federal budget.

The Centers for Medicare and Medicaid Services (CMS) is a federal agency within the U.S. Department of Health and Human Services. CMS oversees and regulates federal healthcare programs such as Medicare, Medicaid, and State Children’s Health Insurance Program (SCHIP). CMS collaborates with individuals, groups, and law enforcement organizations to prevent and determine fraud and abuse.

State boards regulate healthcare professions by overseeing licensing and renewals, enforcing professional standards, and inspecting facilities. They may also take disciplinary action when standards are not met. There are many state healthcare boards, but only the following disciplines have prescribing authority or direct access to medications: pharmacy, nursing, medical, osteopathic, dentistry, optometry, podiatry, and veterinary.

From Laws to Practice: Examples of Pharmacy Fraud and Abuse 

Remember Charlie? A month into his new job, he takes this CE program, reviews the earlier claims, and realizes that he entered override codes even though prior approval was never obtained. Charlie becomes worried that he might have followed bad advice.

PAUSE AND PONDER: Did Charlie knowingly commit fraud, or did he make a mistake after receiving misleading guidance? What responsibilities does Charlie have to correct past claims or disclose potential issues?

Fraud in healthcare can be committed by an individual, group, or organization.⁷ In the pharmacy setting, fraudulent activity often involves improper billing or reimbursement practices.

Pharmacy Billing and Reimbursement Fraud

Several types of billing fraud can occur in the pharmacy, such as billing for prescriptions that were never dispensed (“phantom claims”), dispensing a different quantity than prescribed without documentation, or refilling prescriptions without authorization. Additional fraudulent billing practices include billing for a brand-name drug while dispensing a generic (or billing for a more expensive generic than what was dispensed), adding medications to prescriptions without dispensing them, and submitting claims without an invoice to document purchase.²⁸

What does this look like in pharmacy practice? Here are two real-life examples involving mismatched quantities coming in versus quantities going out: A pharmacy did not have documentation supporting the medication quantities billed to Medicaid as compared to the quantities purchased from vendors over four years. The case settled for $1,333,660. Another pharmacy had similar documentation gaps; the case settled for $42,521.²⁸

See the SIDEBAR for more real-world examples of fraudulent healthcare schemes and consequences.

SIDEBAR: From the Headlines: Health Care Fraud Cases Involving Pharmacists^29-36

Between 2017 and 2022, a pharmacist submitted fraudulent claims to Medicare for medications that were never dispensed in violation of the FCA. He created fake patient profiles and fraudulent prescription entries, resulting in more than $1 million in Medicare payments to the pharmacy. In 2023, the pharmacist plead guilty to one count of healthcare fraud and was sentenced to 2 years in federal prison (after facing a maximum of 10 years). He was also ordered to pay $1.138 million in fines and restitution, and the state board of pharmacy ordered that he surrender his license.

From June 2014 to June 2020, a pharmacist defrauded Medicare and Kentucky Medicaid by billing for prescriptions that patients never received in violation of the FCA. The pharmacist also submitted inflated reimbursement claims by billing for expensive diabetic test strips while dispensing a less expensive item. The pharmacy collected $627,614 from the healthcare payors for the fraudulent prescriptions and $102,441 for the fraudulent test strip claims. She was sentenced to 20 months in prison with 2 years’ probation after release. She was also ordered to pay $730,056 in restitution, and she surrendered her license.

A pharmacist who owned a pharmacy and served as the pharmacist-in-charge coordinated a healthcare fraud scheme with two co-schemers, resulting in more than $300 million in fraudulent Medi-Cal (California’s version of Medicaid) claims. In early 2022, Medi-Cal suspended its prior authorization requirements while transitioning to a new payment system. From May 2022 to March 2023, the pharmacy billed Medi-Cal $306,521,392 for high-reimbursement, non-contracted generic drugs that normally would have required prior authorization and received approximately $204,032,151 in payments. Investigators allege that these medications were not medically indicated, often weren’t dispensed, and involved kickbacks to the two co-schemers. The co-schemers allegedly received more than $36 million in kickbacks, which the pharmacist referred to as “consulting services.” One co-schemer was a nurse practitioner who received kickbacks for writing the fraudulent prescriptions without evaluating patients, medical records, or medical necessity. The state charged her with two counts of healthcare fraud. The other co-schemer was involved in laundering money from the fraudulent payments and has been charged with one count of healthcare fraud. In August 2024, the pharmacist pleaded guilty to two counts of healthcare fraud. At the time of this writing, he is awaiting sentencing and facing a maximum of 10 years in jail for each count of healthcare fraud. This conduct not only violated the FCA by submitting claims for services not performed but also violated the AKS.

Medical Provider Healthcare Fraud

Healthcare providers may also commit fraud. Examples can include double billing (submitting multiple claims for the same service), phantom billing (billing for a service, visit, or supplies that was never received), unbundling (billing components of a service separately), or upcoding.²²

Patient or Individual Fraud

Although not the focus of this activity, pharmacy staff should be aware of fraudulent schemes involving patients or individuals. Examples include forged or altered prescriptions, doctor shopping (seeing multiple providers to obtain prescriptions for controlled substances), diversion (selling one’s prescription medication), health care provider impersonation (billing for services or supplies without a license to do so), and benefit card abuse (using someone else’s health care card or allowing someone else to use it).²² Awareness of these patterns may help pharmacy staff recognize fraudulent activities.

Speak Up! Don’t Look Away: Addressing Fraud and Abuse

Prompt reporting of suspected fraud is critical to maintain compliance with laws and regulations, and to maintain the financial viability of the healthcare system. There are several ways to report suspected fraud or abuse.⁷

In some cases, self-reporting may result in less severe penalties.²⁸ If one realizes the billing process was questionable, the very first step is to stop submitting problematic claims. Next, individuals should consider obtaining legal counsel specializing in healthcare fraud to evaluate legal practices or risks. Individuals should determine how much money was collected in error and return overpayments. If an investment or suspicious relationship is involved, end it! If appropriate, individuals should consider self-disclosure to CMS or OIG.⁷

So, what does Charlie do? He reports his concern to the pharmacy manager, who audits the claims and corrects the errors. Charlie and the pharmacy team receive additional training to prevent future mistakes. Hazel’s intent and the extent of her use of override codes—and those she influenced—were evaluated during the internal audit. No legal action is taken because the issue was caught early, reported internally, and corrected. Additionally, there was not intent to defraud—it appears to be negligent error.

The pharmacy manager uses the incident as a choose-your-own misadventure learning example. She discusses the following potential outcomes with Charlie:

• If Charlie had continued billing incorrectly even though he knew or suspected it was wrong, he could have been subject to consequences including criminal charges, civil charges, or license suspension/revocation.
• If the manager ignored Charlie’s concerns, the pharmacy and/or manager could have faced a federal investigation and penalties. Charlie could have been protected by whistleblower protection laws if he chose to file a file a qui tam case.
• If the miscoding practices were discovered during a third-party audit, consequences could have included civil penalties and a criminal investigation (to determine intent) for the individuals involved and the pharmacy.
• If Charlie had recognized and reported the miscoding right away, it would have triggered an internal investigation with possible disciplinary action for Hazel. It also would have eliminated Charlie’s liability.

Contact Information: How to Report Suspected Fraud or Abuse⁷

If a beneficiary (patient) wants to report:

CMS Hotline: 1-800-MEDICARE (1-800-633-4227)

OIG Hotline: 1-800-HHS-TIPS (1-800-447-8477)

https://oig.hhs.gov/fraud/report-fraud/index.asp

U.S. Department of Health and Human Services

Office of Inspector General

ATTN: OIG Hotline Operations

PO Box 23489

Washington, DC 20026

Complaints specific to Medicare Part C or Part D: 1-877-7SafeRx (1-877-772-3379)

If a Medicare or Medicaid provider wants to report:

OIG Hotline: 1-800-HHS-TIPS (1-800-447-8477)

https://oig.hhs.gov/fraud/report-fraud/index.asp

U.S. Department of Health and Human Services

Office of Inspector General

ATTN: OIG Hotline Operations

PO Box 23489

Washington, DC 20026

Contact MAC (Medicare Administrative Claiming) (https://www.cms.gov/mac-info) or Medicaid State Agency

MAC can also address billing procedures, errors, or questionable practices

The OIG hotline is anonymous; however, providing contact information is preferred so that follow up can occur.⁷

DIVERSION AWARENESS FOR PHARMACY STAFF

Diversion is the unauthorized acquisition, use, or distribution of drugs.³⁸  It can occur with medications that fall under the Controlled Substance Act, such as opioids, benzodiazepines, and/or stimulants, and non-controlled medications.³⁹ Diversion can happen at any point in the supply chain and by either healthcare workers or patients.⁴⁰ This activity will focus on diversion by healthcare workers.

Diversion of Controlled Substances

Addiction often drives controlled substance diversion in healthcare environments, with opioids identified as the most frequently diverted medications.³⁸ Table 3 lists commonly diverted controlled substances. Diversion of controlled substances can cause significant harm to the patient, healthcare worker, and healthcare facility.

Table 3. Commonly Diverted Controlled Substances^38,40

Diversion of controlled medications by a healthcare worker can result in patient harm in several ways. Consider a hypothetical situation in which a healthcare worker tampers with a vial of an injectable controlled substance. The worker removes half of the contents for her own use and replaces the remainder with another clear liquid, which may or may not be sterile, using a technique that is definitely not sterile. Patient harm can result due to^41-43

• An inadequate control of pain or anxiety from a subtherapeutic dose.
• Risk of infection if the product administered is contaminated due to the addition of a nonsterile diluent or needle sharing. For example, two outbreaks occurred in 2018 due to contamination:
  • An emergency department nurse in Washington diverted a medication and it resulted in 12 cases of hepatitis C
  • A cancer center nurse diverted medication in New York leading to 6 cases of Sphingomonas paucimobilis bacteremia.
• Risk of allergy or intolerance if the patient receives a drug other than the one prescribed due to diversion of the prescribed agent.
• Potential for adverse outcomes, such as errors and complications, if a patient receives direct care from a healthcare worker who is actively and acutely impaired, as this impairment will significantly compromise clinical judgement.

Diversion also poses personal and professional harm to the healthcare worker, including the risk of overdose. Diversion and administration of injectable agents present the potential for infection due to unsterile or unsanitary self-injection techniques or contamination, along with transmission of bloodborne illnesses. Professional risks include felony prosecution, civil charges, and license suspension or revocation. The worker is also liable for fraudulent documentation in the medical record and fraudulent billing if the patient or insurance provider was billed for a medication that the patient did not receive.⁴²

Additionally, the risks associated with the diversion of controlled substances extend to the employer or health care organization. Regulatory and legal consequences include the ramifications of fraudulent billing, liability for damages, and diminished community confidence in the healthcare system.⁴¹

Behavioral patterns of healthcare workers may be associated with potential medication diversion. Red flags include^38,44

• Unexpected absences or late arrivals
• Disappearance from the worksite (frequent extended bathroom breaks or excessive time in the medication storeroom)
• Extra time at work (appearance on scheduled days off, seeking overtime, early arrivals, staying late)
• Consistently removing controlled substances towards the end of a shift
• Erratic productivity
• Errors with insufficient explanation
• Poor relationships with colleagues, including isolation or avoidance
• Insistence upon personal administration of injected medications to patients
• Trends with waste: too much or too little, delaying waste documentation procedures until the end of shift, or documenting waste with a variety of healthcare colleagues
• Trends with work areas: offering to work in non-assigned areas, preferring patients with controlled medications, or prioritizing work alongside new employees or orientees
• Creating false orders or “prefill” orders

Diversion of Non-Controlled Substances

Let’s check in on Charlie. A few weeks go by, and Charlie is settling into his job. He has become more comfortable with the skills and responsibilities required in his position and is adapting to the workplace culture. He notices that Hazel likes to do things her way and on her own. When Charlie tries to unpack the refrigerated delivery one morning, she takes over, telling him “I always do this. It’s too hot to leave the refrigerated items out, and I’m the fastest at putting them away.” He also notices that she’s frequently on the closing shift. When he offers to stay late so she can go home on time, Hazel says “I’ve got it. My roommate borrowed my car and is picking me up late anyway, so I might as well be the one who stays.”

Recently, Charlie has had trouble filling prescriptions for a popular injectable GLP-1 receptor agonist medication. It seems that the pharmacy can’t keep it in stock, even though the ordering system shows several recent deliveries. Hazel often tells patients the medication is on backorder.

When reviewing two GLP-1 receptor agonist prescriptions marked as “returned to stock,” Charlie can’t find the product in the refrigerator. Hazel says they were restocked earlier, adding that she will adjust the inventory herself. Charlie also notices documentation that two additional boxes were “damaged due to temperature excursion,” but he doesn’t remember a recent refrigerator breakdown.

PAUSE AND PONDER: Does Hazel’s behavior demonstrate red flags? Why are discrepancies with non-controlled, high-cost medications concerning?

The incidence of non-controlled diversion has been rising. Because non-controlled medications may not be as tightly regulated as controlled medications, they may be easier to acquire through illegal means. Individuals may divert non-controlled medications, especially high-cost products, for their own use, resale, or to supply friends or family members who can’t afford the cost.³⁹

High-cost medications that are commonly diverted include antiretrovirals and oncology medications. Other agents often diverted are performance-enhancing agents (such as erythropoietin) and psychoactive medications (such as cyclobenzaprine, quetiapine, and trazodone).³⁹ The sedative and anxiolytic effects of atypical antipsychotics have increased their desirability for misuse or diversion. These medications can be used alone for insomnia or anxiety or in combination with other illicit substances for either calming or enhancing effects.⁴⁵

Another potential area for diversion involves medications used in the management of opioid use disorder, including diphenhydramine (for histamine-induced pruritus), ondansetron (for withdrawal-related nausea and vomiting), and naloxone (for overdose reversal).³⁹

Picking up the Pieces: Prevention and Reporting

In a perfect world, medications would make their way to patients without illegal interception by an intermediary. But this world—the real world—isn’t a perfect one, and diversion happens. How should the pharmacy team handle it?

At the end of the month, Charlie is reviewing a routine inventory variance report for high-cost medications. When he completes a physical count of the items in stock, Charlie finds that the pharmacy is short four boxes of the GLP-1 receptor agonist medication. The system shows two prescriptions that were billed and later reversed to “never picked up,” and two boxes that were documented as “temperature excursion — product damaged.” However, the refrigerator logs do not show temperature fluctuations for that time.

PAUSE AND PONDER: How should Charlie address this discrepancy?

The strongest defense is a good offense. Some strategies for preventing and detecting diversion include³⁸:

• Establishing a diversion program. This is a big task, and it can be challenging to find the time, energy, and resources when it is simply tacked on as an additional responsibility to an existing job description. Ideally, a position (or positions) would be dedicated solely to this role.
• Establishing to whom the program reports internally—compliance, risk management, legal, pharmacy, nursing, and so on. This will vary depending on the size and structure of the organization.
• If appropriate, including members across all disciplines in the organization, such as pharmacy, nursing, anesthesiology, medical directors, security, risk management, compliance, legal, human resources, occupational health, and employee assistance programs. Organizations can consider creating a subset Response Team for initial investigations.
• Having policies for diversion monitoring, investigation, and events.
• Conducting audits to identify and investigate discrepancies sooner rather than later. Early action may minimize risk to patients, employees, and the organization.

Monitoring for diversion of non-controlled medications may require a more nuanced strategy. Because these medications aren’t regulated as stringently as their controlled counterparts, they may be more easily diverted. The above recommendations apply for assessing non-controlled diversion, along with a few additional points³⁹:

• Identify non-controlled medications at risk for diversion and consider storing them like controls—locked and routinely inventoried.
• Monitor inventory, especially noting excessive restocking and unexpected unavailability.
• If appropriate and/or feasible, utilize diversion analytics software programs to identify access, dispensing, and behavior patterns.
• For facilities with automated dispensing cabinets, review reports for overrides (who and what), canceled transactions, inventories, and discrepancies. Investigate any outliers.
• Establish a confidential reporting system for employees.
• Investigate and respond to all suspicious findings.
• Educate employees about commonly diverted non-controlled medications and the steps provided by the facility to prevent, identify, and report suspected diversion.
• Use staff feedback and facility data to evaluate and adjust the process as needed.

Charlie brings the discrepancy to the pharmacy manager, who begins an official internal audit. The audit shows that the claim reversals and inventory adjustments for the missing GLP-1 receptor agonist medications were completed with Hazel’s credentials. Security footage from two closing shifts shows Hazel placing small, boxed items from the refrigerator into her personal bag after other staff had left during times that correspond with the claim reversal.

PAUSE AND PONDER: How does reporting differ for controlled versus non-controlled discrepancies? What consequences could one expect for Hazel’s actions?

Controlled diversion requires reporting at local, state, and federal levels. Local law enforcement should be contacted, and the appropriate state licensing boards should be notified.^38,40,46 The state health department should be notified if patient risk occurs, such as tampering or product contamination.⁴³ If the diversion occurred after the prescription was filled and dispensed, it should be reported to the state Medicaid agency–even if it was filled using private insurance or cash. Incidents with diversion are often linked to other acts of fraud, waste, or abuse involving Medicaid, and reporting each occurrence may help to identify other activities.⁴⁰

Under federal regulations, DEA registrants (such as pharmacies) must notify the appropriate DEA field division office within one business day after discovery of significant loss of a controlled substance, and DEA Form 106 must be filed within 45 days.⁴⁷ Additionally, the FDA Office of Criminal Investigations (FDA-OCI) holds federal jurisdiction and can assist facilities when drug tampering of a controlled substance is involved.³⁸

Although controlled diversion carries stricter federal regulations, noncontrolled diversion is unethical, unprofessional, and can lead to significant legal and financial consequences, including license suspension. Incidents of non-controlled diversion usually are addressed by an internal investigation and documentation, state board notification, and local law enforcement notification.⁴⁶ Staff should correct insurance claims if applicable. Notification of the DEA is not required for non-controlled diversion.

How is the loss addressed at Charlie’s pharmacy? The pharmacy manager places Hazel on administrative leave and begins an investigation. Law enforcement is contacted regarding suspected internal theft of prescription medications. The compliance and legal departments are notified, the loss is documented, and the affected insurance claims are reviewed.

CONCLUSION

Where does this leave Charlie?

The next Saturday night, Charlie closes the pharmacy and meets with his new friend, Harry, who also works at the pharmacy.

“Well, this has been…” Charlie pauses to find the right words.

“Interesting,” volunteers Harry.

The two colleagues reflect on the past several weeks. They agree that they have both learned a lot in a short amount of time. They now understand the importance of accurate billing practices and prompt reporting of miscoding errors, and they appreciate that management implemented training to prevent future errors. They are also aware of medications with potential for diversion, along with behavioral red flags that may suggest suspicious activity. Charlie has even volunteered to spearhead a diversion program that encompasses both controlled and non-controlled products, including inventory assessment and staff education.

Together, they can look forward to stronger pharmacy practices related to billing accuracy, diversion prevention, and regulatory compliance.

Download CE Activity