The pandemic is creating chaos in many healthcare environments.

Hospitals have been flooded with COVID-19 patients, forcing staff to take on new roles, while pharmacies are scrambling to accommodate curb-side deliveries, home health services, and the rising demand for testing in a quarantined environment. This strain on their resources may be causing some organizations to put administrative tasks on hold -- but that could be a costly mistake.

In the midst of all the chaos, one thing remains constant – healthcare organizations must adhere to rigorous controlled substance compliance programs, or face stiff fines from the Drug Enforcement Agency (DEA).

DEA is still conducting in-person and remote inspections of pharmacies and hospital systems across the country, and failure to adhere and stay current with regulatory requirements has resulted in some massive civil fines. In many cases, fines are being levied against quality healthcare systems that faltered because their compliance program lacked the necessary structure and rigor to stay up-to-date through this crisis.

Fortunately, these failures can be avoided with an effective compliance strategy built around best practice standard operation procedures (SOPs).

The four pillars of compliance

A successful healthcare industry compliance program is based on two documents: the Controlled Substances Act (CSA), which defines the mechanism for substances to be controlled; and the Title 21, Code of Federal Regulations (CFR), Part 1300 to end, which defines specific compliance requirements.

These requirements fall under four categories

Registration: To legally possess any controlled substance, an organization has to be registered with the DEA. That registration is tied to where the substances will be stored, so it is important that registrants have a proper state license for all handling facilities.

A common registration mistake occurs when hospital pharmacies supply controlled substances to off-site clinics or medical offices that aren’t registered. Even if they track the provision of controlled substances through these clinics, if the clinic isn’t registered, it is considered illegal distribution.

If you aren’t sure whether an off-site facility needs to be registered, contact the DEA and ask.

Record-keeping. Every registrant is required to keep current records of every substance manufactured, imported, received, sold, delivered, exported, or otherwise disposed of through their facility. Records should track the substances journey through the system, including acquisition, distribution, dispensing, and filling of orders. These records account for what you've received, used, and disposed of.

Healthcare facilities must also factor ‘corresponding responsibility’ into their record-keeping protocol. While responsibility for prescribing and dispensing controlled substances falls on the prescribing practitioner, a corresponding responsibility rests with the pharmacist who fills the prescription. If the pharmacy that fills a prescription is under investigation, practitioners will need thorough documentation of why they wrote any prescriptions filled at that pharmacy to verify their legitimacy.

Reporting Theft and Loss. All controlled substance thefts must be reported in writing to the DEA within one business day upon initial discovery, or it is considered a violation. The official report of theft is done via DEA Form 106, however, if a facility needs time to conduct further investigation, they can alert the DEA in an email or fax in one business day, with a promise to follow up with Form 106 when all the facts are gathered.

The DEA also requires that ‘significant controlled substance losses’ be reported. The agency does not define “significant,” but suggests registrants consider these points:

To avoid confusion, consider establishing a committee to conduct a loss analyses and to document the rationale for any reporting decisions made.

Security. All controlled substances must be held in secure locations with limited access if possible. Hospitals must have effective controls in place to prevent diversion which requires controlled storage areas to have adequate locks, safes, security alarms and/or cameras.

Hospitals also face additional security risks related to diversion caused by undocumented waste, falsification of documents, and access to Automated Distribution Machines (ADMs). DEA investigators will pay close attention to any diversion risks. Having a robust compliance program with clearly defined security SOPs to prevent diversion is the best way to mitigate these risks and avoid hefty fines.

The inspection process

Prior to an unannounced inspection, DEA will already have done considerable research on what a healthcare facility orders, its prescription trends, and any loss or theft reports.

When they arrive, they will typically provide a notice of inspection. This a voluntary document asking for consent to review the premises and records that are required to be kept. If a facility declines the request, the DEA will then obtain an administrative inspection warrant to examine records required to be kept Less commonly, investigators will present a criminal search warrant, which means they have probable cause to believe that illegal distribution is occurring. A warrant cannot be declined.

Once on site, investigators will want to review all compliance documents and security SOPs, and conduct an accountability audit comparing all purchased inventory against dispensations over a period of time, with an explanation for any deviations.

We suggest hospitals and pharmacies maintain all of these documents in an accessible format or “DEA Readiness Book”, and provide investigators with a dedicated workspace and quick access to all requested documents. The sooner investigators have what they need, the faster this process will go.

Facility staff working with investigators should collect receipts for all documents provided, and consider conducting a parallel audit, tracking all of the documents they review to ensure they are aware of the investigation trend and findings.

Avoiding violations

The most common cited violations result from failure to maintain complete and accurate records, failure to report theft and significant losses, and failure to maintain effect controls to prevent diversion. First-time offences or minor issues will generally result in verbal guidance or a Letter of Admonition.

In more severe cases, investigators may require an Administrative Hearing, Order to Show Cause, civil fines and/or criminal prosecution. In these cases, it’s not uncommon for fines to exceed $1 million, so it is vital that regulations be followed.

Many hospitals and pharmacies mitigate these risks by working with third-party compliance experts to help them build a rigorous compliance program, and ensure compliance is maintained.

Facilities considering this option, should look for vendors with former DEA regulators and policy makers on staff who understand the intricacies of DEA inspections and culture. They also want to be sure these vendors can offer secure virtual inspections and remote accountability audits, which are necessary during the pandemic and can bring efficiency to any audit preparation process.

Working with an expert is the best way to identify and eliminate compliance risks and ensure that the inevitable DEA inspections will run as smoothly as possible.