Hospitals across the country have bought software that monitors every controlled-substance transaction and flags suspicious patterns. A federal enforcement record made public this summer shows what happens when those alerts are generated, and nobody acts on them.
West Virginia United Health System, doing business as West Virginia University Health System, agreed to pay $4,177,139 and enter a three-year Memorandum of Agreement to resolve civil allegations that it violated multiple provisions of the Controlled Substances Act across its registered facilities between 2017 and 2024, according to the U.S. Attorney's Offices and the Drug Enforcement Administration. The system holds 53 DEA registrations. It did not admit liability.
For patients, the relevance is not the dollar figure. It is that drug diversion inside a hospital is felt by the person in the bed, usually as pain medication that does not work.
Inside the DEA Findings at a 53 Registration System
The DEA began investigating after learning a nurse had stolen controlled substances from one of the system's facilities, a pattern that repeats across these cases: one incident triggers a systemwide audit.
According to an analysis of the settlement published by the FDA Law Blog, the investigation found the system had identified numerous internal thefts by employees that were not always reported. An expert review commissioned by the system itself flagged diversion problems that leadership knew about but which were not implemented at every facility. Employees suspected of diverting were not always interviewed. State licensing boards were not consistently notified. Some facilities hired people with prior diversion histories.
The system admitted certain factual points without admitting liability, including errors on federal order forms, records that were not complete and accurate at some facilities, and one facility that conducted no biennial inventories. Investigators also documented pre-signed prescriptions and prescription pads, and employees pocketing controlled substances or taking them home.
The federal announcement listed the violations plainly: failures to notify the DEA of thefts or significant losses, errors in controlled-substance orders, inaccurate inventory records, improper authority for DEA order forms, and policies not fully consistent with federal law. A statement from the health system followed the announcement the same afternoon.
Detection Software Only Works When Someone Opens the Alert
The compliance agreement is unusually specific about technology, and it reveals the assumption regulators think hospitals get wrong.
The system must use commercial diversion surveillance products and, critically, must document what happened after each alert. Discrepancy resolutions identified by the software must be clearly documented for each issue, with records, notes, and interview reports attached. Facilities must escalate investigations rather than close them silently. Each registered location must keep a central watch list of employees whose transactions trend toward suspicious activity.
That requirement exists because generating an alert is not the same as detection. An unreviewed alert is arguably worse than no alert because it leads an institution to believe it is covered.
A federal case from Colorado shows the gap concretely. A nurse at Parker Adventist Hospital was flagged by a routine automated dispensing cabinet audit, rated yellow one month for high fentanyl usage and red the next month for high use and waste, with an unusual number of transactions in which drugs were removed and then canceled. She was later sentenced to 44 months for stealing fentanyl meant for intensive care patients. The system flagged her. The flag was not the problem.
Patients Feel Diversion as Untreated Pain and Infection Risk
Diversion is often discussed as a compliance issue. Clinically, it is a patient safety issue with three distinct harms.
The first is undertreated pain. When a clinician removes a dose and keeps it, the patient receives less than prescribed, or nothing at all, while the medical record shows a full dose was given. The patient's reported pain then looks like drug-seeking or poor response rather than a missing medication.
The second is infection. Tampering, where a syringe or IV bag is drained and refilled with a non-sterile substitute, has caused documented bloodstream infection outbreaks in United States hospitals.
The third is impairment. A clinician using diverted opioids while on shift is providing care in an altered state, which is how these cases often surface, through patients and families noticing behavior before any audit does.
DEA Special Agent in Charge Jim Scott, head of the Louisville Field Division, said that "hospital systems stockpile controlled medications with a high potential for abuse," making safeguarding and accurate records essential to preventing diversion.
Cameras, Watch Lists and a Three-Year Compliance Clock
The remediation requirements give a sense of what regulators now consider a baseline. Within 180 days, the system must stand up diversion response teams at every registered location, a systemwide diversion coordinator, and a systemwide diversion oversight committee. Within 120 days, it must implement a diversion policy covering surveillance, auditing, and monitoring of staff with prior discrepancies.
It must interview suspected diverters at the time of drug screening rather than deferring the interview, revoke automated dispensing cabinet access immediately when employees are suspended or terminated, and run comprehensive background checks on new hires who will handle controlled substances. It will cost $2.5 million to install at least 750 security cameras at pharmacy and controlled-substance storage locations, with recordings kept for 3 months and for 24 months where diversion has been identified. Where diversion is reasonably confirmed to have affected a patient, a risk analysis form must be completed and documented in that patient's chart.
This is not an isolated settlement. In the spring, Sutter Medical Center Sacramento and an affiliated surgery center agreed to pay $3.2 million over hundreds of alleged recordkeeping and security violations.
Patients who believe their pain medication is not reaching them can say so directly and ask that it be documented. Anyone who suspects a controlled substance problem at a facility can contact the hospital's patient safety or compliance office, or the DEA field division. MedicalDaily will track compliance reporting under the agreement, which runs for three years.
Key Questions Answered
What did the hospital system agree to? To pay $4,177,139 and enter a three-year Memorandum of Agreement with the DEA resolving civil allegations of Controlled Substances Act violations between 2017 and 2024. It did not admit liability.
What is drug diversion? The theft of controlled medications from a hospital's supply, usually by staff with legitimate access, either for personal use or for sale.
How does diversion harm patients? Through undertreated pain when doses do not reach the patient, infection risk when syringes or IV bags are tampered with and refilled, and impaired clinicians providing care.
Do hospitals not already have systems to catch this? Most do. Automated dispensing cabinets and surveillance software generate alerts on unusual patterns. The federal findings show alerts are only useful when someone reviews, investigates, and documents them.
Was any patient confirmed to be harmed in this case? The settlement resolves allegations related to recordkeeping, reporting, and security. Federal documents describe compliance failures and thefts rather than a finding of specific patient injury.
What should a patient do if pain medication does not seem to be working? Say so directly to the nurse and the treating physician and ask that the report be documented in the chart. A persistent, unexplained lack of response warrants escalation to a charge nurse or patient advocate.
Where can someone report a concern? A hospital's patient safety or compliance office, the state licensing board for the clinician involved, or the DEA's local field division.
