About Hospital Safety Center  
Career Center  
Contact Us
       Free Resources
Hospital Safety Insider

Mac's Safety Space  
        News & Analysis
Healthcare Safety Leader  
Environment of Care Leader  
Forms and Checklists Library  




Drug diversion: Regulatory requirements and best practices


December 29, 2016

Editor’s note: The following is an excerpt from the new HCPro book, Drug Diversion in Healthcare, by author Kimberly New, BSN, JD, a consultant to healthcare institutions on the subject of drug security and diversion. The book will look at the serious issue of drug diversion in U.S. hospitals and provide a comprehensive guide for safety professionals looking to create and maintain a diversion program in their facility.

In many cases, the expectations of regulatory and accreditation authorities are not explicit in regulations, but come to light in the agreements reached, for example, between the DEA and facilities that make settlements for violations or poor practices. In general, the expectation of DEA and other authorities is that facilities adhere to the best available practices for patient safety and drug security, whether or not those practices are spelled out in published regulations. Consequently, there is no real distinction in terms of DEA expectations between what is required and what is considered best practice. The technology and understanding for dealing with drug diversion is evolving more quickly than regulations can be rewritten, and regulatory agencies expect facilities to keep abreast of the best practices available.

Most facilities have at least a core group of stakeholders that recognize the scope of the problem and risks associated with diversion. Unfortunately, even the existence of a diversion program within a facility is not explicitly mandated by regulation, so it may be difficult for committed people to gain support for some of the essential processes. When I visit facilities in which administrators are resistant to my recommendations, an argument I hear often is, “Just show me the regulations that require it.” They are not usually content with best-practice guidelines. There are several controlled substance– and diversion-related requirements with which facilities must comply, which can support the diversion program effort. Some sources for requirements include CMS, DEA, FDA, EPA, survey agencies, and state professional boards. There are also a number of best practices and guidelines available to provide guidance and support. Sources for guidelines include ASHP, CDC, and ISMP, to name a few. Finally, additional guidance and expectations can be gleaned from DEA settlement agreements with healthcare facilities. Some of the basic requirements and expectations are discussed below.

Patient safety
The pharmacy has ultimate responsibility for medications throughout the hospital. The Interpretive Guidelines for the Medicare Conditions of Participation (CoP) state, “The hospital’s pharmacy service must ensure safe and appropriate procurement, storage, preparation, dispensing, use, tracking and control, and disposal of medications and medication-related devices throughout the hospital, for both inpatient and outpatient services” (Interpretive Guidelines 42 CFR §482.25(a)).

Hospitals generally must provide safe environment of care for patients, one that is free from the threat of abuse or harm (42 CFR §482.13(c)(2)). The hospital must also ensure that the medical staff is accountable to the governing body for the quality of care provided to patients (42 CFR §482.12(a)(5) and 482.22(b)).

In order to comply with these patient safety–related requirements, hospitals must keep controlled substances secure so as to prevent tampering and substitution. Nursing staff and anesthesia providers, particularly those in procedural and operative units, who fail to keep controlled substance injections secure impose a substantial risk to patient safety. Irrespective of whether the services are provided directly by hospital employees or indirectly by contract, the hospital is responsible for requiring staff to comply with state and federal law (42 CFR §482.12(e)). This means that even if anesthesia staff are contracted, the hospital has responsibility for requiring them to comply with state and federal regulations and with relevant patient safety standards (42 CFR §482.12(e)(1)).

The hospital also has a responsibility to ensure that the care delivered by non-employed nursing staff meets hospital policies and procedures (42 CFR §482.23(b)(6)). This includes compliance with controlled substance handling requirements. Agency nurses are often implicated in drug diversion cases, so in order to comply with this requirement, they must be monitored closely. Due to the relatively short duration of their assignments, their controlled substance transactions should be monitored more frequently than those of employed staff.

The CoPs require that hospitals have ongoing surveillance to identify “infectious risks or communicable disease problems” in any particular location (Interpretive Guidelines 42 CFR §482.42). This CoP requirement is meant, in part, to facilitate early identification of an outbreak. In light of the many reported diversion cases that have resulted in bloodborne pathogen transmission to patients, and in conjunction with this responsibility, infection prevention departments should be apprised of all confirmed drug diversion cases.

Patient privacy
Hospitals and other institutions are required to protect patient information and keep unauthorized individuals from accessing private healthcare-related data (42 CFR §482.13(c)(1) et seq and 42 CFR §164 et seq). Many times when diversion occurs, the diverting staff member has snooped in patient records to locate patient identities that would be ideal to divert under. It is important to review each diversion case for the possibility of a privacy violation and work with the institutional privacy officer to ensure that any violations are appropriately addressed.

Security and medication handling requirements
The CoPs require that institutions have policies and procedures in place that prevent, to the extent possible, diversion of controlled substances (Interpretive Guidelines 42 CFR §482.25(a)(3)). In order to comply with this directive, facilities must have specificity regarding controlled substance handling in their policies and procedures, and must insist on compliance with expected practices.

The CoPs require that all drugs and biologicals must be kept in a secure area, and locked when appropriate (42 CFR §482.25(b)(2)(i)). This means that controlled substances need to be stored in such a way as to prevent unauthorized access by anyone. Secure areas must be accessible only to authorized individuals (Interpretive Guidelines 42 CFR §482.25(b)(2)(iii)). “Authorized individuals” must be identified by job class in hospital policies and procedures, and those procedures must also indicate how unauthorized access is prevented.

Automated dispensing cabinets (ADC) are recognized in the CoPs as a secure option for controlled substance storage. If ADCs are used, it is important to consider the Institute for Safe Medication Practices (ISMP) guidelines for ADC use, including password security, unit-specific privileges, biometric access, locking storage in refrigerators, returning unused medications to a designated return bin, and implementing blind counts for controlled substances (ISMP Guidance).

The CoPs state that drugs can’t be administered without a valid order by a physician, and those drugs available on override must be strictly limited to those that might be needed immediately in emergency circumstances (42 CFR §482.23(c)(1) et seq and Interpretive Guidelines 42 CFR §482.25(b)). This requirement is meant to ensure that appropriate safety checks are in place prior to administration, but it is also relevant to the diversion prevention effort. One popular method of diversion is to pull controlled substances via an override transaction. Hospitals should regularly review their list of overridable controlled substances, and keep that list as narrow as possible.

The CoPs require that quantities of medications dispensed must be limited to prevent diversion, and that patients must be assessed to ensure that medications have their intended effects (Interpretive Guidelines 42 CFR §482.25(b)(1)). Monitoring for the removal of excessively large doses is one way of preventing diversion, but limiting the dosage size available based on the needs of the patient population being served is also an effective preventive measure.

Although hospitals may permit patients to self-administer their own medications, hospitals are required to keep self-administered medications safe and secure. Owing to the increased security requirements for controlled substances, hospitals should only allow self-administration of these drugs in very limited situations. In fact, the CoP Interpretive Guidelines state, “Hospitals… generally should not include such medications as part of a patient self-administration program (Interpretive Guidelines 258).

ISMP guidelines suggest that wasting of unneeded controlled substances happen at the time the medication is removed from secure storage (ISMP Guidance, Core Process 2). As discussed in more detail in a subsequent chapter, the DEA, EPA, and FDA have all identified regulations or expectations regarding controlled substance waste disposal. Local waste treatment regulations may also impact how a facility approaches controlled substance disposal. Because controlled substance waste is a common source for diversion, it is important to have a compliant process for disposal in place, one that doesn’t facilitate diversion.

The CoPs and DEA regulations require that current and accurate records must be kept of the receipt and disposition of all scheduled drugs (42 CFR §482.25(a)(3) and 21 CFR §1304.04 et seq). This includes having complete records for all controlled substances from the time of procurement to administration, waste, or return via the reverse distributor. This also includes being able to track all controlled substances that leave the pharmacy and ensure that they are received into stock at the intended location, and also to track controlled substances that are removed from stock in remote locations to ensure they are received back into stock in the pharmacy. All institutions should have a meaningful daily or per-shift reconciliation of drugs that leave or are expected to be returned to the pharmacy. This requirement also applies to situations in which drugs are manually accounted for. For instance, many facilities use manual records to track the administration and wasting of patient-specific controlled substances. Nursing documentation may not be sent to pharmacy as it should be, and pharmacy doesn’t follow up to be sure the documentation is received. This is a situation where complacency is not an option.

The CoPs require that all records demonstrating the movement of controlled drugs within the institution must be readily retrievable (21 CFR §1304.04 et seq). This means that facilities must be able to produce all records relating to controlled substances without delay, not just those records relating to procurement and inventories.

Discrepancies are required to be reconciled “promptly” (21 CFR §1304.04 et seq). The term “prompt” is explained in the CoPs by citing the Merriam-Webster online dictionary definition where “prompt” is described as being performed “readily or immediately” (Interpretive Guidelines 42 CFR §482.24(c)(2)). This interpretation supports the policy that most facilities have requiring that discrepancies be resolved by the end of the shift. It also means that discrepancies cannot be left unresolved for extended periods of time, and discrepancy resolution must be consistently monitored.

Subscribe Now!
Sign up for our free e-newsletter
About Us | Terms of Use | Privacy Statement | Contact Us
Copyright © 2019. Hospital Safety Center.