How Prepared is Your Facility for a Visit from the DEA? with Susannah Herkert Senior Managing Director at Guidepost Former DEA Supervisory Diversion Investigator
Why do so many facilities still run into trouble with the DEA when we all have access to the CFRs? Susannah clearly articulates the main issues and provides some things to ponder. She offers ideas for mitigating much of the risk and bringing your facility into better compliance. She provides a bit more clarity surrounding some of the regulations.
Transcript:
Terri
Welcome back, everybody. Today. My guest is Susannah Herkert, the senior managing director at Guidepostedited. Susannah served with the DEA for more than 15 years. She trained the DEA personnel to investigate violators of the Controlled Substance Act. Her experience and that of her team are what Guidepost is built on. Their services are for DEA registrants, and the services include diversion, compliance, training, and investigations. And today, we’re going to talk about both of those things. So, Susannah, I find it welcome, by the way. I find it really interesting that we have the CFRs at our fingertips, and yet facilities still fall prey to findings with the DEA. Now, that’s no judgment for all those facilities out there. Been there, done that. It gets overwhelming. But for some reason that even though we have the regulations, we still miss things or perhaps we misinterpret things, which is where I want to start today. Why do so many places still have gaps when it comes to diversion compliance, when we all have access to the regulations?
Susannah
You bring up a great point, Terry, and it’s something that we see at so many DEA registrants, whether it’s a distributor, a hospital, or a pharmacy. They have the CFR. They have a great understanding, typically, of what the CFR says, but it’s not necessarily put into action correctly. So, for example, we have the Biennial Inventory. We see that as often a computerized inventory and not an actual physical count of what’s on hand. And so that’s just an example of a difference between what the CFR says and then what’s actually being done. And so a lot of what we have seen is just it’s a failure to translate the CFR into what that means for DEA compliance. And so the CFR obviously has hundreds of pages of very detailed information about what registrants must do based off their specific category. So, for example, security record keeping is different from a retail pharmacy than a manufacturer.
And sometimes they’re not applying the correct regulations, or they just don’t have all of that detail that they need in their DEA records. They may have some of it, but not all of it. And so it’s just a lot of detail. And as we know, these are healthcare facilities. These are very busy businesses, and so things get missed, and then it often does not come out until they are subject to a DEA inspection. And that’s where we see the civil fines and the letters of admonition come in because they just weren’t completely ready.
Terri
Yeah, that makes sense. And those regulations are kind of in that legalese format, right, which is like, okay, could you just speak English, please, and tell me what it is I need to do? You mentioned the Biennial Inventory and the electronic so here’s one that I could probably get caught on. Depending on what your answer is, the items that you have in your automated dispensing machines on the day of inventory can you use that as an electronic or do you have to literally, physically that day go and physically count everything that you have?
Susannah
So what you just described is something we’ve seen with healthcare facilities misinterpret everywhere. They rely on those automated dispensing, cabinet printouts as what they have on hand, but that does not meet the DEA requirements. DEA is a physical count of what’s on hand. And so it’s on that day, and it has to be the same day you have to do a physical count of all ADCs, all pharmacy, all expired. And so that’s where a lot of those discrepancies come in. When DEA comes in and does an accountability audit because there were not actual physical counts.
Terri
Yeah, which is hard to do. You’ve got a large facility. You only have so many people, so how can you even possibly get that done? And then you have to put beginning of day right or end of day. Well, this is going to take me 4 hours in the day to work this out. So how does somebody logistically do that? And what is okay in terms of beginning of day or end of day when it comes to that?
Susannah
Exactly. And part of the protocols we work with on healthcare facilities is you have to timestamp your physical counts of every single ADC, because obviously you’re a 24/7 facility. You cannot shut down a hospital to do these counts. And so maybe there’s a dispensation after a certain time and you can go back and reconcile that after you do your physical counts. But the beginning of business, close of business, does need to be on your inventory. But we always recommend adding an Asterisk explaining that it’s twenty four seven and document the time that you completed your inventory.
Terri
Okay. Yeah. All right. That’s a big one. I bet you there’s lots of places that aren’t getting that right. I know ones that I’ve worked at aren’t getting it right.
Susannah
Correct.
Terri
Okay.
Susannah
Yeah.
Terri
But they will remain nameless. Okay. So obviously facilities all have to be in line with all of the regulations. But from your experience, if the DEA comes in and they look at, say, the two or three things that they know are maybe low hanging fruit or would indicate that you’re not doing a great job at being compliant, and let’s say that you’re doing those things very well. The location is doing a great job. Do you find then that the DEA would kind of minimize the risk? Because the DEA will be like, okay, well, they’re doing all of these things perfectly, we can stop looking or not look as hard, or is an investigation and investigation. They’re going to look at everything no matter what they see right off the bat.
Susannah
Well, that’s a good thing to kind of discuss because DEA has changed in the healthcare space in the last five years. So I would say prior to five years ago, you would not routinely see DEA as you would Joint Commission or Board of Pharmacy. They did not do scheduled or standard inspections at healthcare facilities. That’s changed. And we are now seeing an increase in DEA showing up to do just standard investigations, or what DEA calls cyclics or audits. And those investigations are going to include a deep dive. It’s going to be everything from your security around controlled substances to your record keeping to your reporting. How do you report theft and loss? What are your controlled substance training programs like? And they’re also going to probably do an accountability audit. So they are going to pull eight to ten controlled substances and do a complete accountability of everything that came in and then went to the end user or patient during a certain time period.
And so that’s the same that DEA does at a distributor, a manufacturer, some retail pharmacies. But we’re seeing an increase in those types of investigations in the healthcare facilities, which is why we help prepare the DEA binder or the DEA inspection binder. And so to your point, Terry, that shows DEA readiness. It shows compliance by having all of those DEA required documents in a readily retrievable manner in a binder ready for that DEA inspection should DEA come on site. And it might keep DEA from doing a deeper dive. If they see all of the records are here in one place, they’re taking compliance seriously. They understand their obligations as a DEA registrar.
Terri
Okay? Yeah, I can imagine. They’re probably quite busy. They got lots of places to go to. So if you can pass that first beginning piece of it, then it might be, okay, we’re done here. We’re moving on to the next one. Okay, so we talked about the biennial inventory. Are there other things that you still routinely find and you kind of just scratch your head? It’s like, why are these still gaps a reality after it’s getting more and more press, shall we say that the DEA is out there and starting to come in? Absolutely.
Susannah
The power of attorney forms, we often see those filled out incorrectly. When the CFR was updated or changed in 2019, it changed. Who can sign a power of attorney? So as a corporation or a partnership or an LLC, it has to be a corporate officer. And so depending on the structure of the healthcare facility, that pharmacist might not be considered a corporate officer. And so knowing who can sign that DEA registration application, and then who can designate that power of attorney? So we routinely see that as an issue. And then that would also affect your controlled substance ordering system or your seesauce how you receive your controlled substances. So we call it back to the basics of DEA, which is not always common sense. As we said, the CFR can be a little convoluted and a little hard to follow in some of these categories.
And then with the implementation of that electronic controlled substance ordering system. It changed how controlled substances are received now online, and so making sure that’s done properly and it all goes back to who can do that, who has power of attorney. And do you have your basic registration requirements met along with that? I would say the third category that we’ve seen with healthcare facilities is not being properly registered with DEA. And so as we talk about getting back to the basics, DEA has been very focused on these off site locations with healthcare facilities. So there’s an off site surgical center that has a different physical address that is across the street. It needs to have a separate DEA registration. And so a lot of healthcare facilities we have worked with are just not properly registered with DEA, which can create pretty extensive civil fines.
Terri
Interesting. Yeah, definitely. Back to the basics. I spoke to somebody not too long ago that they ended up in trouble because it was one of those DEA registration and sending meds off site. And that’s the way it had kind of been for years. And then it came to light that, okay, this is not compliant. So, yeah, definitely things you just don’t think about, especially if you’re hired on and you just assume you’re in place, that everything has been in place before you got there, I think. Okay. Do you find that with more and more of these big cases? I mean, I feel like it’s more and more. I don’t feel like this was the case ten years ago where these cases are splashed all over the media when it comes to diversion and DEA findings and stuff like that. Maybe I just was not looking for them.
So I’m more aware. But with these big cases that are in the media, is it having any effect on the facilities? Are you finding more people are paying attention to compliance and asking for assistance? Or are they just kind of doing the Ostrich approach where they’re like, oh, I think we’re doing okay, and we’ll just hope they don’t come in?
Susannah
So I think it’s a combination. I would say about half of our healthcare facility clients are proactive right now, meaning they haven’t had a DEA event and they just want assessments of their DEA compliance. And then the other half are reactive. They’ve either been placed under a memorandum of agreement or a non prosecution agreement, or they’ve had some what we call triggering event with either FDA or the DEA or FBI that they want assistance in remediating or enhancing their controlled substance anti diversion program. And so we see a combination of both. But a lot of these facilities recently have been dealing with triggering events or diversion events that brings DEA on site. And something that we’ve noticed that’s changed in the last few years with DEA is DEA used to operate more of a partnership with hospitals and making sure that we hold the diverter accountable.
And so it would be more of a partnership between the healthcare facility and DEA in ensuring that nurse or that pharmacy tech is held accountable, where now there’s that accountability. But now DEA is circling back around and saying, why did you not have effective controls to guard against diversion in place to detect this? And so then they’re civilly finding the hospitals for allowing this diversion to happen or not having those effective controls in place.
Terri
Interesting. Yeah, that actually ties really well into my next question, and that is if there’s a diversion event, and I asked this question of William at Natty, but I want to ask it of you as well. If there is a diversion and the DEA comes in and they find that the facility does have a program in place, not just in name only, but really does have a solid diversion program in place, but somebody has found their way around it. Maybe there’s a gap that the facility missed or just a new creative way that got past everything. Does the DEA show more leniency to that facility? I mean, obviously there’s going to be less findings, right, because they’ve got a good program in place. But when they do find something that is lacking, do they give that facility any credit for what they have done in that solid program?
Or are they going to hit you with that finding the same way they would someplace else? That it might be the fifth finding in a row that they find. But either way, they’re going to hit you just as hard as if you didn’t have a program for that particular finding. You know what I’m trying to say?
Susannah
Yes, exactly. And so I will tell you that it’s very different for how DEA is going to assess those. And if you have a strong anti diversion program, and to your point, that’s not just in writing, but it’s actually a functional program. The employees have been trained on it. They can speak to it, whether it’s electronic, it’s also manual, but it has multiple facets to your drug diversion program in place, then the civil fine or potential DEA action is going to be less, in my opinion. I have seen where DEA goes in, and as DEA will tell you, and I believe this wholeheartedly, you’re not going to prevent 100% of diversion, but if you have programs in place to detect, prevent and investigate early on, something that might you might identify at one week or at one month. But the facilities that it doesn’t come up for eight months.
Terri
Right.
Susannah
Or a year. And so you have a massive amount of diversion, that’s when DEA is going to come in and really evaluate your diversion program and why this went undetected for that period of time or for that large quantity of diversion. And so when these one off events happen, they’re detected quickly, investigated and reported appropriately. NDEA comes in and says, hey, you had a very sophisticated electronic monitoring program. Your employees were well trained. You had a manual audit program. You had all of these things set in place, and this was just a sophisticated one off diversion event, then it’s far less likely that they’re going to be civilly fined higher quantities.
Terri
Yeah, that’s a good point. It’s the time, it’s not that you’re going to prevent at all, but how long did it take you to find it? If you’ve got a solid program, then you should find it quickly. Very good point. I’ve heard that the DEA never leaves without finding something. Is that true?
Susannah
So I will tell you, DEA typically does find something, and that’s because there is so much discretion in evaluating security. So the CFR says that you have to have effective controls to guard against diversion and theft, but it doesn’t have a list of these are the ten things you need to have as effective controls. So if your diversion event happens in a medication room where you didn’t have a camera, well, DEA is going to have a finding that you did not have effective controls, or that camera could have potentially detected it. Or if pharmacy tech is able to put it in their backpack and walk out the door with it undetected, DEA will come back and say, you didn’t have effective controls for policies around personal belongings in your pharmacy. And so there are a lot of different findings that are open for interpretation based off what the diversion event that happens.
Susannah
And so that’s why having a robust diversion program that everyone’s trained on and understands, because to that point, DEA will come in and they will interview employees if a diversion event happens. And I can tell you, when I was in DEA and doing investigations routinely, I would hear, well, I wasn’t trained on that, and I didn’t know I was supposed to report that, or I didn’t understand what an impaired worker looked like. And so we really saw a lack in training, a lack in understanding of what they should do. And that’s when DEA will assess a lot of findings around those employee interviews and what they find during their inspection.
Terri
Okay, that makes sense. Yeah, all those things are pretty important to have. So let’s move into the investigation phase. In terms of a diversion investigation, are there things that I mean, you’ve mentioned some things already, but other things that facilities should be doing in this phase that can make all the difference. So they’re setting up the mitigation strategies, of course, and educating so everyone knows what they’re looking for, what to do, when to report. But are there any other things that you think are pretty big that a facility should be doing that can make all the difference?
Susannah
So I think it’s about accountability. What we’ve seen at a lot of facilities is they have the policies and procedures in place, but employees are not following them. And so doing those monthly roundings, doing the monthly roundtable meeting. We say that leadership in pharmacy and leadership includes nursing leadership, anesthesia leadership, hospital leadership, and pharmacy should be meeting monthly to talk about anything they’ve seen, trends, concerns, things that need followed up on from the diversion space. And we all know that hospital has often have meeting fatigue, but including a diversion discussion at least monthly, we have seen issues be identified before they became bigger issues. And so having those meetings and then also having accountability checklists. And so it should not all be just on the pharmacy, but CFO or CEO, they should have checklists monthly that they’re auditing pharmacy on certain aspects, whether it’s spot checking invoices records of receipt, reviewing their accountability audit, but just having those routine things in place for that accountability, including nurses monitoring waste.
So we have seen huge issues involving proper wasting of controlled substances that have led to overdose deaths at facilities. And so having that accountability of is wasting done properly and are we spot checking the cameras and then holding those individuals who do not waste accountable. And so I think I would tie it up into accountability and actionable items that are reviewed on a monthly basis to make sure that nothing’s slipping between the cracks.
Terri
Yeah, accountability is absolutely huge. One thing I think that’s very enlightening are for those facilities that go from a manual auditing process or no auditing, and then they get the diversion surveillance software in, and then you start to look at how many things are going wrong, right? How many unaccounted for partial wastes or administrations the staff is not doing, how many delayed administrations or delayed wastes. It’s a little mind boggling. It’s like, oh my gosh, this is what’s happening. And then that accountability piece of it, because I don’t think, I mean, some nurse managers certainly are great at responding to that and like, come on, we got to get this going a little bit better. But it takes a long time to move that needle and that culture. But you’re right, it’s the policies and procedures that are there. Not that everybody reads them by any means, but that’s what we’ve got to hold people accountable to.
Because then you’re going to see when people drift, right? But when you first gain access into all of that data, it’s like, oh my gosh, everybody’s drifting. I mean, we need to fix that up. So that accountability piece, the first time you and I spoke, you said something that I hadn’t thought about before. And that was when you’re interviewing somebody that will elicit a confession either about not following policies or about possibly diversion. And I never thought about going for a confession of not following policies. So talk to me a little bit more about that. Absolutely.
Susannah
When healthcare facilities bring us in to assist with their diversion investigations, a lot of times there’s going to be admission about diversion at some point during that discussion, but how we usually start those interviews is we’re going to get them to admit to a policy violation. Nine times out of ten, they know that they have violated the policy in something they’ve done. So we will go in and review their documentation before we ever interview them. And we’re going to find where there was an administration or a waste or some record that they did not complete accurately. And so we will go in with that evidence and then talk to them about the policy, establish that they know what the policy says, what they’re supposed to do, and show them evidence where they deviated from the policy. And so that’s one of our approaches in the interview.
So once they start admitting to policy deviations, then we lead down to, well, isn’t it possible that when you deviated from this policy, maybe you took that waste with you and that will often lead to yes, that’s possible. That could have happened and then we lead it into and it happened probably more than once. And a lot of times by the end of these meetings, whether they’re two or 3 hours long, we often get a confession that, yes, I did this on at least 20 occasions. Here’s where I was storing it at my house, here’s how I would get it from the facility. But it really starts out with a discussion around simple or may seem simple policy violations just to get them talking about things that they know that we have them on because their signature is not there, the required information is not in those records.
Terri
Interesting. Is it your process that you go kind of transaction by transaction and lay that out for them or is it kind of a general policy says to waste after 30 minutes and we can see that you don’t do that?
Susannah
Yes. And some of this, whether we’ve done a lot of these with EMS where there have not been waste witness on the EMS records that they’re required to give back to pharmacy. So whether if we can do it one by one, depending on the individual we’ll go through and have an entire stack of those that have not been done properly and then lead them into, hey, what do you think this looks like? When we have 56 policy violations, do you think you might be someone that we would want to talk to about these missing controlled substances? Well, yes, that makes sense. And so really, just from our background in DEA, it’s getting them to admit to certain things that are much easier to admit to and building that rapport with them before we lead them down the evidence that we have that leads us to believe they were the ones diverting the controlled substances.
And then we also show where the other individuals that they were working with completed their waste documentation appropriately. So we show, hey, your coworker in this situation, they did not do any of this. So why do you think we’re talking to you? And so we kind of use some of that peer group analysis as well in our interviews.
Terri
Okay, yeah, that makes sense. So it’s not typically what do you recall about this transaction and what you did it’s more well, you didn’t do it this day, you didn’t do it here. You didn’t do it here. And just kind of showing them not really asking for an explanation on each one, but letting them know that there were several that fell out of that policy violation. Okay, that makes sense. In addition to what you’ve already shared, which has been a lot of fantastic information, are there a couple of additional main words of wisdom that you would have for every DEA registrant?
Susannah
So I think going through mock inspections, putting yourself through a mock DEA inspection, I think we’ve seen a lot of facilities have that AHA moment because they’re used to joint Commission, where they can often remediate on site. That’s not something you can do with DEA. So having that preparedness before DEA comes on site practicing, doing accountability audits, I will tell you a lot of the pharmacists that I’ve worked with, the DEA computation charts are different than anything they’ve ever worked with. And so the vast majority of them have variances the first time they do these computation charts. Whether you’re running pixis or Omnicell or acidose, it’s challenging to get those distribution records because DEA requires distributions to the patient not from your pharmacy to your ADC, but from your ADC to the end patient. So you have to run those reports to get all of those distributions of if it’s fentanyl 200 per two, you have to get that for the entire time period.
And then you have to have all of your records of receipt from your controlled substance ordering system, and you have to have de expects zero variance. So while the vast majority of facilities we’ve worked with, they eventually get there, they have to learn how to run those reports because of the expired return to bins what’s dispensed, you have to really weed out some of that through pivot tables and computation charts to get to that zero variance. And so it’s a lot of work, but every pharmacist that’s gone through this is that they’re glad they’ve done it now, as opposed to when DEA is standing over their shoulder and there’s that readily retrievable requirement that these records are readily retrievable. And so putting yourself through those mock inspections, doing those accountability audits of several drugs to make sure you can run those reports to DEA standard is going to make a DEA inspection go much smoother.
Terri
Okay, so, yeah, I’m overwhelmed. I can see why people just do the Ostrich thing. It’s like, you know what? Maybe I’ll never have to worry about this. I’m just going to take my chances. All right. Yeah, that is a lot. Well, this has been great. I want to thank you. This is great information. It’s just one more thing, I think in pharmacy is so heavily regulated. I mean, so heavily regulated. And this is just one more area where it’s regulated, and it’s better to know ahead of time how to run those reports and to find what you’re going to need to find in the event that you need to find it. But I think it also points to facilities. And I know you go everywhere with all DEA registrants, but when it comes to a hospital facility, get that diversion program up and running, because maybe you won’t have to go through this if you have a solid diversion program as well that’s up and running.
