Suspected Hydrocodone Diversion and Reporting Obligations
A Michigan pharmacy's monthly inventory shows 120 hydrocodone/acetaminophen 10/325 tablets unaccounted for over 10 weeks. The pharmacy uses a perpetual inventory system and a keypad-entry safe. Access logs show the safe was opened 14 times outside scheduled shifts, all by one pharmacy technician's code. The technician is a 12-year employee and recently divorced. The PIC confronts the technician, who denies taking anything and becomes tearful. The PIC has not notified the DEA, the Board of Pharmacy, or corporate loss prevention. The pharmacy's policy says to call corporate first. The PIC is unsure whether to wait for corporate before making any report. The pharmacy remains open, and the technician's safe code is still active.
1. What are the PIC's reporting obligations, and should the PIC wait for corporate?
Read the worked answer
A significant loss of a controlled substance triggers federal and state reporting duties. The pharmacy should report the theft or significant loss to the DEA, typically using DEA Form 106, within one business day of discovery, and should also follow Michigan Board of Pharmacy requirements for reporting loss or theft. The exact state form and timing should be confirmed against current board guidance, but the key judgment is that the obligation belongs to the registrant and is not suspended while corporate investigates. Waiting for corporate can cause the reporting deadline to pass.
The PIC should notify corporate loss prevention immediately and in parallel, not sequentially. The PIC should preserve the perpetual inventory records, access logs, purchase invoices, dispensing records, and video. The PIC should not alter the inventory or create replacement records that obscure the loss. If the loss is later determined to be a recordkeeping discrepancy rather than theft, the report can be amended, but the initial good-faith report should not be delayed.
2. What immediate actions should the PIC take to secure the drug stock and protect the investigation?
Read the worked answer
The PIC should deactivate the technician's safe code and any other access credentials, change shared codes, and restrict controlled-substance access to the minimum necessary staff. The PIC should perform a targeted count of all high-risk controlled substances, not just hydrocodone, and document the count with a second witness. The PIC should preserve the original logs and video in a secure location and avoid discussing the details with other employees who do not need to know.
The technician should be removed from controlled-substance duties pending the investigation and handled according to HR policy and legal advice. The PIC should not conduct a prolonged accusatory interrogation, threaten prosecution, or promise leniency. A factual, witnessed interview is preferable, with the employee given a chance to respond. Patient care should continue, but the pharmacy should consider whether the remaining staffing is sufficient to meet legal supervision and counseling requirements.
3. How should the PIC handle the technician's employment status and confidentiality?
Read the worked answer
The PIC should involve HR and legal counsel before making employment decisions, because the investigation may involve both criminal and licensing issues. The technician may be placed on administrative leave while the count and records are reviewed; that is a neutral step that protects the investigation and the workplace. Any interview should be documented, factual, and limited to what the technician saw or did. The PIC should avoid telling other staff that the technician stole drugs, because that conclusion has not been established and could create defamation or privacy problems.
If the evidence supports diversion, the pharmacy should follow its reporting obligations, which may include the Board of Pharmacy and law enforcement, and should document the basis for the report. The technician's long tenure and personal difficulties do not change the reporting duty, but they are relevant to a fair process. The PIC should also examine system vulnerabilities, such as shared codes and weak after-hours controls, and correct them as part of the CQI and security response.