My DEA Number Was Stolen by an Employee and Used to Self-Prescribe Controlled Substances

Most doctors have various licenses that provide them with unique identification numbers. If any of these identification numbers find their way into the wrong hands it can be detrimental to the healthcare provider’s practice, their patients, and the public. Doctors hire support staff to run their practice efficiently by perform tasks that they don’t have time to do or don’t have the training to perform. This employer-employee relationship requires a certain level of trust from both parties because a bad act by either party can have a negative impact on the other party’s license, privileges, or reimbursement for services. Some of the support staff working in a doctor’s office may have access to HIPAA-protected information and a doctor’s unique identification numbers, such as his NPI and DEA numbers. What should you do if one of your employees steals your DEA number and uses it to self-prescribe controlled substance through e-prescribing or traditional prescription pads? What if they use your DEA number to order controlled substances for the practice without your knowledge or consent? Doctors should also be concerned with their potential liability for the unauthorized use of their DEA number.

Reporting Requirement

According to Florida Statute §893.07(5)(b), if your DEA number has been stolen and used to divert controlled substances you must file a police report with the local sheriff of that county within 24 hours after discovery. A person who fails to report a theft or significant loss of a controlled substance commits a misdemeanor of the second degree. It is not required that you press charges against the perpetrator of the theft, but I always recommend that my clients do so for several reasons. First, it shows authorities that you were not complicit in the theft. Second, it becomes part of the employee’s record and prospective future employers will be able to see this information on their criminal history during background checks. Third, as punishment for the emotional despair you will endure, negative impact on your practice, and the cost to hire an attorney to represent you in this matter.

You must also notify the Drug Enforcement Agency (“DEA”) within one business day upon discovery of a theft or significant loss of controlled substances. “Upon discovery” means that a report should be filed once the doctor has made a good-faith effort to determine whether a theft has in fact occurred. To determine whether a loss is significant the DEA provided the following factors in 21 C.F.R. § 1301.74(c):

1) The actual quantity of controlled substances lost in relation to the type of business;
2) The specific controlled substances lost;
3) Whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals, or whether the loss can be attributed to unique activities that may take place involving the controlled substances;
4) A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses; and, if known,
5) Whether the specific controlled substances are likely candidates for diversion; and
6) Local trends and other indicators of the diversion potential of the missing controlled substance.

The six factors mentioned above are not exhaustive and should be taken into account with other factors where appropriate.

According to 21 C.F.R. § 1301.76(b), the DEA’s implementing regulations for the Controlled Substance Act, all DEA registrants must complete DEA Form 106 and submit it to the DEA electronically or by mail. Once submitted, the DEA will begin the investigatory process and contact you to obtain additional information.

Additionally, you should contact the board or association that grants you your license to practice (i.e. Florida Board of Osteopathic Medicine) to see what reporting requirements they may have. For example, although I could not find a clearly defined rule requiring so, the Florida Board of Osteopathic Medicine (“FDOM”) strongly suggests that the doctor file a complaint with the Florida Department of Health (“DOH”) against the perpetrator of the crime so that they may conduct their own investigation into the matter. The complaint should be sent to the Consumer Services Section of the DOH. You will typically receive a response from the DOH within ten business days at which point in time they may schedule a phone call or an in person meeting as part of their ongoing investigation. This investigation may include interviewing parties in your practice about the perpetrator or the crime and facts and events that gave rise to the incident.

During all stages of the investigation, whether talking to the DEA, local police authorities, or the DOH you must be candid with the investigating authorities so that there isn’t any indication of impropriety on your part.

Steps To Prevent A Theft From Occurring Again

To limit the occurrence of future thefts or significant loss, providers should do the following:

• Conduct employee background checks for all employees, including those employees with access to controlled substances. This background check should be performed in any local, state jurisdiction where the employee has worked and resided. Federal background checks should also be performed.
• Schedule I and II drugs must be stored separately from other drugs in an approved safe. Schedule III and IV drugs must also be kept under lock and key but the security measures are more relaxed than their counterparts.
• Utilize tracking software that records specific employee’s removal of controlled substances from locked cabinets together with an associated patient identifier. The software is designed to flag and alert the doctor of suspicious or unusual employee activity.
• Providers should also conduct periodic internal audits to ensure that the inventory of controlled substances is accurate.
• Providers may also want to consider a adopting a policy into their practice which requires employees to be periodically drug tested and suspicion-based drug testing. Drug testing should be performed prior to employment; the offer of employment should be conditional on a clean drug test.
• Sparingly share you DEA number and e-prescribing log-in information only with trusted employees.
• Make sure that your prescription pads are locked up in a secure area. Utilize watermarks on your prescription pads because it makes it more difficult to replicate.
• Monitor remittance advice, claims and reimbursements to verify billed services match your income.
• Observe and takes notes of erratic or unusual behavior by an employee (i.e. lying and mood swings) and physical abnormalities, such as “track marks”, excessive sweating, pale skin, red face with red eyes, etc.
• Implement a training program to educate staff on controlled substance diversion.

 

Conclusion

If you are unable to determine whether a theft of controlled substances did in fact occur within one business day, you should err on the side of caution and file a report with the DEA and other appropriate authorities. It may also be necessary to notify the Center for Medicare and Medicaid Services If you fail to timely report a theft or significant loss you may face penalties and fines or any other remedial actions that the authorities deem are necessary. If any patients were affected by the theft you must determine how to appropriately notify your patients. Make sure to gather any documents or evidence that can be useful for authorities during their investigation. Any theft of prescribing pads should be reported to the Board of Pharmacy.

****

This post was authored by Jamaal R. Jones, Esquire of Jones Health Law, P.A. for more information contact me at (305) 877-5054; email us at JRJ@JonesHealthLaw.com, or visit our website at www.JonesHealthLaw.com.

It should be noted that I am not your lawyer (unless you have presently retained my services through a retainer agreement). This post is not intended as legal advice, it is purely educational and informational, and no attorney-client relationship shall result after reading it. Please consult your own attorney for legal advice. If you do not have one and would like to retain my legal services please contact me using the information listed above.

All of the information and references made to laws, regulations, and advisory opinions were accurate based on the law as it existed at this time, but laws are constantly evolving. Please contact me to be sure that the law which will govern your business is current. Thank you.