Two software products now monitor controlled substance transactions in most large American hospitals. They flag anomalies in dispensing, waste, and documentation that a human auditor would take weeks to spot. And when they fail to stop a nurse from stealing fentanyl, the reason is usually not the algorithm.
It is that someone has to read the alerts, understand what they mean, and investigate. In many hospitals, that job is held by someone who has several other jobs.
The distinction matters because hospitals are buying these systems as a solution rather than a tool, and the difference determines whether a patient in an operating room gets the pain medication their chart says they received.
Inside the Two Products Most Hospitals Run
Reconciling controlled substances was once a manual task. Someone compared what came out of the automated dispensing cabinet with what was documented as administered to a patient and as wasted, looking for gaps.
After a decade of mergers and buyouts, two products dominate. Wolters Kluwer's Sentri7 is used by about 700 hospitals as part of its clinical surveillance line, and Bluesight's ControlCheck is used by more than 1,500, according to figures the companies provided to KFF Health News. Neither publishes pricing.
Both apply pattern analysis across large volumes of transaction data. Sentri7 monitors roughly 60 risk attributions, indicators that flag a clinician's dispensing behavior for human investigation. The systems do not conclude that theft occurred. They produce signals that a person then works through.
The technology can perform well. A peer-reviewed evaluation of the software funded by the National Institutes of Health tested it in 2022, then known as Flowlytics, against two years of medication data from ten hospitals, searching for 22 nurses already known to have diverted drugs. The program identified all of them, and found them faster than humans by as little as a week and as much as a year and a half. One caveat belongs with that result: the study's primary author worked for Invistics, the company that previously owned the software.
The Failure Point Sits Downstream of the Software
A case at Erlanger Baroness in Chattanooga illustrates the gap. According to a Tennessee Board of Nursing consent order, a nurse anesthetist diverted leftover surgical fentanyl for roughly four months in 2025 while the hospital's monitoring software failed to raise alarms. Co-workers noticed first, reporting that he appeared impaired on duty. The hospital's own audit found approximately five instances in which missing drugs were not flagged, as well as additional inconsistencies between dispensing and waste documentation that should have been caught.
The board suggested the system was in an initial learning phase. A Wolters Kluwer executive disputed that characterization, saying the software has no learning phase because it is trained on 9 to 12 months of historical data upon installation. A company spokesperson declined to answer questions about the case but said Wolters Kluwer remained confident in its software.
Jacob Smith, the pharmacist in charge of drug security at Johns Hopkins Medicine, offered a different explanation rooted in where the software works well and where it does not. In his experience, these tools perform strongly in emergency departments and intensive care units, and less well in operating rooms, where medications are dispensed and charted differently and are harder to track automatically. Those settings, he said, require closer human attention.
His description of how his own institution staffs the work is the part that generalizes. "We've got people whose entire job is to work with this software," Smith said, adding that relying on the software alone to supply every signal means missing things.
That is the staffing model the technology assumes. It is not the model every hospital has funded.
Oversight Gaps That Extend Beyond Any One Hospital
Healthcare facilities are not required to disclose that they use diversion detection software, and there is no requirement to report when it fails. The Drug Enforcement Administration requires hospitals to confidentially report lost or stolen drugs, and hospitals may also report to state health agencies, but those reports need not mention any software involved. No agency maintains a public accounting of how widely these systems are deployed or how often they miss.
Smith noted that hospitals buy these expensive technologies largely because a serious diversion case can produce a multimillion-dollar penalty from the DEA. As he put it, the products promise cost avoidance rather than return on investment.
The patient safety stakes are documented. The CDC reports that diversion has been linked to at least 13 disease outbreaks causing more than 200 infections, mostly hepatitis C, since 1985.
Diversion is not rare. The nonprofit Healthcare Diversion Network estimates that as many as 15 percent of all healthcare workers divert drugs at least once.
Practical Ground for Patients and Clinicians
Patients cannot audit a hospital's diversion program, and the practical implications are narrower than the headline suggests.
The direct patient safety risks are two in number. A patient may not receive the pain medication documented as administered, resulting in inadequate treatment during a procedure or recovery. And tampering, when someone refills a vial or line, introduces the risk of infection. The documented hepatitis C outbreaks followed exactly that pattern.
Anyone whose pain is not controlled after a procedure should say so clearly and repeatedly rather than assuming the dose was correct. That is reasonable advice regardless of diversion, and it is the only signal a patient realistically has.
Families concerned about a specific hospital can ask whether it has a designated diversion prevention program and who staffs it. Accredited hospitals maintain controlled substance policies, and patient relations departments can route the question.
Clinicians struggling with substance use have confidential options that do not begin with an enforcement action. Most states operate alternative-to-discipline programs for nurses and physicians that provide monitoring and treatment while protecting licensure. The federal SAMHSA helpline at 1-800-662-4357 offers free, confidential referrals.
The regulatory question that remains open is whether any agency will require hospitals to report failures in diversion detection. None does now, which is why the Erlanger case surfaced through a nursing board order rather than a safety reporting system.
Key Questions Answered
What is drug diversion? The theft of controlled substances from a healthcare facility, typically by staff with legitimate access. The nonprofit Healthcare Diversion Network estimates as many as 15 percent of healthcare workers divert at least once.
Does the detection software work? It can. A 2022 NIH-funded study found one system identified all 22 known diverters in a ten-hospital dataset, sometimes more than a year faster than humans. It also missed repeated instances in a documented case in Tennessee.
So what is the actual problem? The software produces signals that a person must review and investigate. Experts describe the work as a dedicated job. Hospitals that treat the software as a complete solution rather than a tool are the ones exposed.
Where does the software work least well? Operating rooms, according to a Johns Hopkins drug security pharmacist, because medications there are dispensed and charted differently than in emergency departments and intensive care units.
Are hospitals required to report when it fails? No. Facilities must confidentially report lost or stolen drugs to the DEA, but they are not required to disclose that they use this software or to report malfunctions, so no full public accounting exists.
How does this affect patients directly? Two ways. A patient may not receive documented pain medication, and tampering with vials or intravenous lines introduces a risk of infection. Patients whose pain is poorly controlled after a procedure should say so clearly.
What if a healthcare worker is struggling with substance use? Most states run alternative-to-discipline programs offering monitoring and treatment while protecting licensure. The SAMHSA National Helpline at 1-800-662-4357 provides free, confidential referrals at any hour.
