Corporate Liability from Employee Diversion: Costly on Many Fronts

On June 8, 2022, the U.S. Attorney’s Office for the Western District of Virginia, announced that   Sovah Health (“Sovah”), a two-campus health system in Danville and Martinsville in southern Virginia, had entered into a non-prosecution agreement (“NPA”) and $4.36 million civil settlement due in large part to the ability of two employees to divert significant controlled substance quantities over extender periods.  Press Release, U.S. Department of Justice (“DOJ”), Sovah Health to Pay United States $4.36 Million to Settle Claims of Controlled Substance Act Violations (June 8, 2022).  This matter is the latest in a recent string of large monetary settlements between the government and health care providers involving employee diversion.  Moreover, the non-prosecution agreement resulting from the criminal investigation illustrates the extent of liability for hospitals and other health care entities and the importance to maintain robust controls and oversight over employee activities related to dispensing and administering controlled substances.  The facts also highlight the health care risks when bad employees change employment only to continue their bad acts.

Lax Controls Provided Employees with Opportunity to Divert

While the two employees in this case devised separate and independent schemes to divert controlled substances, the common element was a lack of an effective corporate security program and monitoring of existing policies and procedures to prevent and detect diversion.  In one case, between 2017 and 2019, a Sovah pharmacy technician diverted more than 11,000 schedule II drugs and 1,900 schedule III and IV drugs by indicating in the computer system that they were moved to a location no longer used by the hospital and she destroyed required drug movement forms.  See Sovah Non-Prosecution Agreement, Addendum A, Agreed Facts, ¶2.  In the second case, occurring from January to May 2020, a registered nurse, admitted to daily tampering of fentanyl vials and hydromorphone injectables wherein she removed the drugs from the vials replacing them with saline solution.  It was alleged that other employees administered the medication to patients even after observing signs of tampering, although no patients were reported harmed.  Id. at ¶3.

The government alleged that Sovah failed to conduct a full physical inventory during this period which would have identified the pharmacy tech’s diversion exploiting that a non-utilized location was still in the computer system.  In addition, Sovah failed to enforce or audit procedures requiring that all transfers of controlled substances be witnessed by two employees, that sequentially numbered forms should be maintained in a designated binder and that key-card controlled security cage be locked. In short, the employees were provided the opportunity to not only commit the crimes but that they went undetected.

Both the pharmacy tech and the nurse plead guilty and were sentenced to 13 months and 36 months in federal prison, respectively. See Press Release, DOJ, Danville Pharmacy Technician Sentenced for Federal Drug Charge (Aug. 18, 2020); Press Release, DOJ, Former Nurse at Danville Hospital Sentenced for Tampering with Prescription Opioid Drugs, Making False Statements (Feb. 4, 2022).  It is worth noting that the nurse was separately sentenced to 4.5 years for admitting to committing similar crimes from July to November 2020, while subsequently employed by the Novant Health Forsyth Medical Center in Winston-Salem, North Carolina.  Press Release, DOJ, Nurse Sentenced to 54 Months for Drug Tampering (June 1, 2022).  It is unclear from the publicly available documents whether the nurse had changed employment because of suspicions about her illegal conduct at Sovah, but it highlights the public health risks if such activity goes undetected and/or unreported.

Costly NPA Requirements: More than Just Money

In addition to the significant civil monetary penalties Sovah has agreed to pay, the company is also required to comply with certain extraordinary compliance terms for four years.  See generally, NPA ¶¶6(a) – (q).  While some of these are standard terms we have seen in such agreements (e.g., compliance with all regulations, giving DEA unannounced inspection authority, conducting background checks, etc.), some of the requirements could find their way into future agreements involving similar cases of employee diversion.  These include:

1. Sovah is required to install cameras at each automated dispensing machine (“ADM”) that are positioned to capture placing and removing controlled substances. DEA regulations require “adequate security” but do not specially require cameras in health care facilities.  This requirement could be costly at some locations given the increased number of ADM’s in use and the costs of maintaining a record of the camera surveillance.
2. The NPA requires “management” review of “any discrepancies discovered during an employee’s blind count when accessing controlled substances.” The NPA requires that software should monitor which machines and employees experience discrepancies and Sovah must maintain all blind counts and employees must document actions to resolve/reconcile discrepancies.  Requiring “management” to have an active role is obviously intended to ensure corporate accountability in the future.
3. Sovah is required to report any potential thefts, losses, or abuse/diversion by employees be reported not only to DEA but to the Virginia State Police. While many registrants routinely contact law enforcement, requiring this as a required procedure also heightens corporate responsibility.  Sovah also must maintain a policy requiring employees to report such arrests or charges to management.
4. Sovah must also establish a mandatory random drug testing program for employees with access to controlled substances and test employees at least every six months. Positive test results must be reported to the appropriate licensing authorities.  Neither the federal CSA nor DEA regulations require drug testing.  DEA has traditionally been concerned that mandating such requirements for all DEA registrants could run afoul of some state restrictions.
5. The NPA requires Sovah to create and implement a written policy of progressive discipline for employees with controlled substance access who violate Sovah’s controlled substance policies and procedures. In our experience, companies can be inconsistent in taking disciplinary action for violations involving controlled substances. This requirement provides Sovah with clear direction to enforce disciplinary action against employees for such violations.
6. Sovah must also “conduct a full physical inventory annually” of schedule II-V controlled substances on-hand consistent with DEA biennial inventory requirements that specifically includes drugs in the ADMs and vault. As stated in the NPA, this is more than just a “count” but also requires a reconciliation of the counts, something DEA regulations do not require as part of a biennial inventory.  The NPA states that Sovah report to DEA the results “24 hours after conducting the inventory.”  We expect that that Sovah could provide an “inventory” within 24 hours, however, we believe it will be difficult for Sovah to reconcile all discrepancies within 24 hours of taking the count.  This may require Sovah to maintain a perpetual inventory, something again not required by DEA regulations.
7. In addition to the annual inventory requirement, Sovah must conduct an accountability audit of at least two schedule II medication formulations each quarter and provide the results to DEA within two days. The question here is whether Sovah will have the ability to reconcile any discrepancies in the accountability audit or just report the results within two days.  If the latter, this could trigger false positives of potential diversion.
8. Finally, the NPA requires an annual self-evaluation to review compliance with all CSA regulations and the terms of the NPA. The Pharmacist-in-Charge (“PIC”) or DEA-designate is required to certify they have completed the evaluation and document any corrective action.  The certifications must be maintained for two years and must be available to DEA.  This imposes a heavy burden on the PIC although we are aware of several state boards of pharmacy that require licensees to conduct self-evaluations.

In summary, we expect that DOJ and DEA will pursue similar compliance requirements in future cases of employee diversion, especially where the lack of corporate policies or compliance fails to provide safeguards against this criminal activity.